CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 1 of 111 PagelD #: 
2749 


Elections Misinformation Reporting Portal 


Benefits to election officials 
e Asingle place (i.e., the portal) for reporting mis- and disinformation across multiple 
social media platforms with a streamlined, consistent user experience. 
An ability to report activity that occurs on multiple platforms at the same time. 
Visibility of what’s going on with mis- and disinformation in the election’s community 
within and outside their jurisdictions, including to see trends and be able to strategically 
respond. 


Benefits to social media platforms 
® Consistent reports of mis- and disinformation that include a standard, consistently 
formatted set of information fields (type of report, screenshots, links,as well as 
narrative explanation of the concern, 
e Anability to accept reports without having to vet the submitter, as those submitters will 
already be vetted by the election’s community upon registration in the portal. This will 
enable them to respond more quickly to a given election official's first report. 


Benefits to state-level elections offices and national associations (NASS, NASED) 

© The ability to look across the elections jurisdictions to identify patterns and potential 
impact of misinformation activity. This will permitnational-level organizations to help 
put priority on response actions and make decisions regarding media engagement in 
parallel with actions taken by the social media companies. 

 Anopportunity to focus efforts at the national level to improve the overall health of the 
election administration across the country. 

e Redirecting resources spention assisting election offices with reporting to those focused 
on remediation activities. 


Benefits to voters 
* More accurate election information available at any given time 
* More rapid.correction of erroneous information, leading to more voter confidence 
¢ An overalhhealthier, more productive social media environment. 
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The core of CISA’s mission is to safeguard American’s critical infrastructure. The nation has seen the 
corrosive effects of mis-, dis-, and mal-information (MDM) across a host of our critical infrastructure 
in recent years, impacting our election systems, telecommunications infrastructure, and our public 
health infrastructure. As there is no shortage of entities working on MDM issues, CISA is evaluating, 
how to best engage in the space in an additive way, while safeguarding our credibility as am, 
independent agency ahead of the next election cycle. { 


« Where We Are. CISA has a burgeoning MDM effort that focuses on building national resilience 
through public awareness. CISA engages with subject matter expertsresearchers, think tanks, 
and public relations experts—to understand the threat of MDM, develop strategies to message 
to the public, and amplify trusted voices. These actions includedirectly.engaging with social 
media companies to flag MDM, and creating a repositoty of factual guides and toolkits. 

* New Initiatives. CISA is bringing on staff to address/MDM relatedito the pandemic and 
incorporate lessons learned into longer-term strategies,’as well as improving our ability to do 
analytics on narrative intervention. We are also working with federal partners to mature a whole- 
of-government approach to mitigating risks of MDM, framing which tools, authorities, and 
interventions are appropriate to the threats impacting the information environment. 

« Where We Want to Go in 2022. Ahéad of midterm elections in 2022, it will be critical to evaluate 
CISA’s role in this space and ensure that the agency is providing additive value that fits within its 
unique capabilities and mission’@ne approach is to recognize CISA’s responsibility for securing 
our election infrastructure — and ensuring CISA is a trusted resource in providing education on 
election processes and procedures to minimize misunderstanding and opportunities for MDM. 
CISA also wants tovensufe it is set up to extract lessons learned from 2022 and apply them to the 
agency’s workin the 2024. 


Questions for the Committee 


1. What should CISA’s role be in the MDM space? How should it leverage its unique capabilities and 
mission to,contribute to this space, without becoming duplicative of other efforts and remaining 
focused on its mission? 

2. How would the Committee balance CISA’s efforts between the need to build resilience to MDM, 
broadly, versus activities to address to MDM narratives, specifically? This distinction can be 
understood as broad public education and awareness campaigns versus rumor control, 
amplifying credible information, type efforts. 

3. How can CISA inspire innovators to partner with the government in a way that catalyzes 
availability of trusted information without being seen as government “propaganda”? 

4. Whatis the right model for CISA engagement with social media and other media entities? 

5. How should CISA and the USG maintain situational awareness of MDM and detect efforts to 
manipulate the information environment? What is the balance between social listening, privacy, 
and protected speech? 
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arbi 
From: |@reingold.com] 
Sent: 5/24/2021 2:28:00 PM 
To: Ho iwitter com 
cc: @cdc. gov] © reingold.com); is 
cdi 
Subject: RE: COVID Misinformation 


i 


| hope you had a good weekend. I’m following up about the partner support portal enrollment for CDC. Does the Twitter 
account need to be connected to a cdc.gov email or is any account fine? Also, would there be any issues or 
complications stemming from flagging COVID misinformation on the portal using the existing censusovaccounts that 
have access? We’|| want to have at least some CDC accounts whitelisted, but that backup may be helpful in the short - 
term. 


Let us know any next steps we can take to make sure CDC is all set with the portal. 


Thanks, 


reingold.com 


We're ona mission. Yours. 


From: EE (CDC/0D/OADC) 
Sent: Tuesday, May 11, 2021 8:50 AM 

10: ES © 1 ittercom> 
Subject: RE: COVID Misinformation 


Does it needito be'the CDGaccount or my personal? If CDC, I’mgoingto have someone onstaff enroll instead of me. 


If personal is OK, itis: 
From: I © twitter.com> 


Sent: Monday, May 10, 2021 8:51 PM 
To: cdc.gov> 
EE 602010 01> 


Subject: Re: COVID Misinformation 


eg 
I'd be glad to enroll youin our Partner Support Portal, which allows youa special, expedited reporting flow in the Twitter 
Help Center. It worked very well with Census colleagues last year. 
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You needa Twitter account (and to be logged into that account) to access the Partner Support Portal. What account (or 
accounts) would you like me toenroll? 


Best, 


On Mon, May 10, 2021 at 5:05 PM i © ccc. cov> wrote: 


| ol don’tthink we have info on how to enroll but we’d be happy to get onif you can send some info. 


Thanks. 


reingol 


Subject: Re: COVID Misinformation 


_ 


Thanks for sharing this - agree these are important trends to note;a quick scan shows that at least some of these have 
been previously reviewed and actioned. | will now ask the team toreview the others. 


Hi ceming me: did you havea chance to enroll inour Partner Support Portal? In the future, that's the best way to 
geta spreadsheet like this reviewed. 


Best. 


On Mon, May 10, 2021 2:50 Pi o5c.20v> wrote: 


We wantedtopoint out two issues that we are seeing a great deal of misinfo about —vaccine shedding and 
microchips. The below are just some example posts. We do plan to post something shortly to address vaccine 
shedding and | can send that linksoon. Our census team copied here, has much more info on itif needed, 


Also, we are standing up a BOLO COVID misinformation meeting and inviting all tech platforms. We are shooting for 
12pm EST on Friday forour first meeting. I’llinclude you on the invite but if you'd like to propose an alternative 
approach or would like to me include others, just let me know. 


Thanks! 
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IM ALARMED BY THE AMOUNT OF WOMEN IN MY DM’S' COMPLAINING ABOUT ABNORMAL BLEEDING AND https://t 
MISCARRIAGES AFTER COMING IN CONTACT WITH SOMEONE WHOSE BEEN VACCINATED!!!!! 

Well hundreds of women on this page say theyare having bleeding/ clotting after vaccination orthat they bleed https://t 
oddly being AROUND vaccinated women, Unconfirmed, needs more investigation. But lots of reports. COVID-19 

Vaccine Side Effects 

[Links to: https://www.infowars.com/posts/vaccine-shedding-causing-miscarriages-and-blood-clots-in- https://t 
unvaccinated-females/] 

So the #CDC now says that those whoare “Fully Vax nated“ can “Go outside & live freely” lol.. Thisisajoke https://t 
Quickquestions forthose who were experimented on! MEAN-Took the shot, what were the ingredients init? You 

did'ASK right? \. Also, do you know what SHEDDING is? 

Here is the official Pfizertrail protocols https://t 


Concerning shedding by the vaccinated 

Fertility (male and female) 

contraception to be compulsorily used because shedding 
Adverse events and serious adverse events reporting 
And much more 


Dangers ore known 
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https://media.tghn.org/medialibrary/2020/11/C4591001 Clinical Protocol Nov2020 Pfizer BioNTech.pdf 


For those of you who have questions about Spiked Protein SHEDDING: Pfizeradmits in its own mRNA vaxx trial https://t 
documentation that non-vaxxed people can be ENVIRONMENTALLY EXPOSED to the shot's spike proteins by 
INHALATION or SKIN CONTACT. 


https://themostbeautifulworld.com/blog/skin-contact-covid 


Pfizer acknowledges the existence of “SHEDDING” in their#mRNA vaccines, and is setting up this newtfial tostudy | https://t 
these dangers. 


(Shedding is where unvaccinated people experience serious health issues just by being near to vaccinated people). 


https://media.tghn.org/medialibrary/2020/11/C4591001 Clinical Protocol_Nov2020 Pfizer BioNTech.pdf#page67 


CAUTION: This message originated@Xternally, Please use caution when lickingon linksoropeningattachments, 
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Sent: 10/27/2020 4:25:44 PM 
te er iii <a 
twitter.com] 
ce: h.chs cov); I cisecurity.org 
Subject: 


FW: Flagging Three Twitter Accounts Impersonating Colorado Government 


Please see below report from Colorado. I’ve asked them if these accounts have already been reported, but these are 
screenshots from today. 


Regards, 


The Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security 
(DHS) is not the originator of this information. CISA is forwarding this information, unedited, from its originating 


source — this information has not been originated or generated by CISA. This informationsmay also be shared 
with law enforcement or intelligence agencies 


CISA affirms that it neither has nor seeks the ability to remove or edit what information is made available on 
social media platforms. CISA makes no recommendations about how theinformation it is sharing should be 
handled or used by social media companies. Additionally, CISA willnot take any action, favorable or 


unfavorable, toward social media companies based.on decisions,about how or whether to use this information. 


From: eis SOS.STATE.CO.US> 
Sent: Tuesday, October 27, 2020 :17 PM 


| 


icisa.dhs,gov> 


OS STATE. CO.US> is OS.STATE,.CO,US> 
NNN SOS.STATE.CO.S>; SINS 0S, STATE,CO.US 


RS 0S STATE.CO.US>; ESOS. STATE.CO.US> 
OS. STATE.CO.US: ; 
SOS.STATE.COUS>; 


MEER 0:12 00.> 


ag! Ne Twidcrassauntsiinbersbnetingcelerade Government 


El-ISAC and CISA Partners, 


Three Twitter accounts i Se a ae es S popped upin the last couple of weeks 


impersonating the Colorado state government. As you may be aware, numerous other similar accounts have also been 
created impersonating other state and city jurisdictionsin recent weeks. The MS-ISAC flagged a couple of them last 


week TD 020 c don’tknowif the third one ID is oneveryone’s radar. Has 
anyone engaged Twitter about these? Welcome any additional information you have. 
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These are concerning to us here in Colorado because of the recent FBI/CISA warnings about impersonation accounts 
spreading false information about the election. For the Colorado accounts: 


. All three joined Twitter this month —October 2020 

. All three have a URL link prominently labeled “Colorado.gov” that takes users to the official Colorado.gov 
website after passing through several other systems that could be harvest data or be more nefarious. 

. All follow/are followed by up toa couple dozen other state/local government impersonation accounts —many 
alsocreated recently. 

. Several look like they were temporarily suspended by Twitter but at least some appear to be back online. 


Below are screenshots taken today of the three accounts: 


Follow 


dm us your weed store location (ho@s be mad, but this is a parody account) 
ad@pov 
55 56 fc % 
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(coe) ( Follows" 


Smoke weed erry day. The official (unofficial) Twitter account of theStatelof 
Colorado. 


© Colorado 


ISA & colorado.gov FF) Joined October 2g2¢ 
21 Follow 


/ >) 
(eee) ( Follow ) 


The (UN)official Colorado Twitter Account. 
This is a parody account. 


© Colorado & colorado.gov fF Join 


Disclaimer: Colorado Department of State is not the originator of the above information and is forwardingit, unedited, 
fromits original source. The Department does not seek the ability to remove or edit what information is made available 
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on social media platforms. The Department makes no recommendations about how the information itis sharing should 
be handled or used by recipients of this email. The Department may also share this information with local, state, and 
federal government agencies. 


Colorado 
Secretary of State 
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twitter.com] 
10/29/2020 2:52:23 PM 


I 2; 5% 
SS a 


isecurity.org 
Re: FW: Case #CIS-MISO00090: potential parody Twitter accounts related to Adams County, CO 


from outside of DHS. DO NOT clicklinks or o} 
SOC with au mene : 


We will escalate. Thank you. 


On Thu, Oct 29, 2020 at 237 PM {I cisa.dhs gov> wrote: 


Please see the below reporting from Colorado. These do not appear to be connected/to the imposter/parody 
accounts previously shared. 


Regards, 
= 


The Cybersecurity and Infrastructure Security Agency (GISA) of the U.S. Department of Homeland Security 
(DHS) is not the originator of this information. CISA is forwarding this information, unedited, from its 
originating source — this information has not been origitiated ergenerated by CISA. This information may also 
be shared with law enforcement or intelligence agencies. 


CISA affirms that it neither has nor seeks the ability toremove or edit what information is made available on 
social media platforms. CISA makes no recommendations about how the information it is sharing should be 
handled or used by social media companies, Additionally, CISA will not take any action, favorable or 
unfavorable, toward social mediatompanies based on decisions about how or whether to use this 
information. 


In the event that CISA follows up tovequest further information, such a request is not a requirement or 
demand. Responding to this request is voluntary and CISA will not take any action, favorable or unfavorable, 
based on decisions about whether or not to respond to this follow-up request for information. 


From: 
Sent: Thursday, October 29, 2020 2:33 PM 
lhg.dhs. OV> RB 2.0 20parinership atlassian. net; _ aes 


isecurity.org> 
Subject: Case #CIS-MIS000090: potential parody Twitter accounts related to Adams County, CO 


Misinformation report: two potential parody Twitter accounts related to Adams County, CO 
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From: OS.STATE.CO.US> 
Sent: Thursda ictober 29. 2020 2:04 PM 


cisecurity.org> 


SOS.STATE.CO.US>; ay 


SOS.STATE.CO.US> state.co.us>; 
SOS.STATE.CO.US> 


Subject: Flagging Twitter Accounts 


EI-ISAC, CISA and Stanford Partners, 


We want to highlight two accounts we found that could be used to imitate official accounts. We are unsure if 
there’s any action that can be taken, but we wanted to flag them for consideration 


These are concerning to us here in Colorado becauseofthe recent FBI/CISA warnings about impersonation 


accounts spreading false information about the election. We haye recently flagged three other accounts 
that, popped up in the last couple of weeks impersonating the 
olorado state government and we wanted to highlight, these new accounts for awareness 


Falinw 


0 ie 


MOLA_DEFSPROD_00007565 


CONFIDENTIAL 


Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 13 of 111 PagelD #: 
2761 


Follow 


123 


w 


Disclaimer; Colorado Department of State is not the originator of the above information and is forwarding it, 
unedited, from its original source. The Department does not seek the ability to remoyesor edit what 
information is made available on social media platforms. The Department makes no recommendations about 
how the information it is sharing should be handled or used by recipients of this email),.The Department may 
also share this information with local, state, and federal government agencies. 


Thanks, 


Colorado 
Secretary of State 


SOS.STATE.CO.US 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is 
strictly prohibited. Please, notify the sender immediately and permanently delete the message and any 
attachments. 
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isecurity.org] 


hg.dhs.gov] 


Thank you, i al 
On Oct 23, 2020, at 6:05 M, RR «i: com> wrote 


Thank you for raising this to our teams. We have actioned these accounts*undenour civic integrity policy 


Thanks, 
On Fri, Oct 23, 2020 at 9:57 AM  &'s2 so wrote: 


Please see the below reporting from Maryland 


Thanks, 


The Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security 
(DHS) is not the originator of this,information, CISA is forwarding this information, unedited, from its 
originating source — this information has not been originated or generated by CISA. This information may also 


be shared with law enforcement or intelligence agencies 


CISA affirms thatit neither has nor seeks the ability to remove or edit what information is made available on 
social media platforms. CISA makes no recommendations about how the information it is sharing should be 
handled or used by social media companies. Additionally, CISA will not take any action, favorable or 


unfavorable, toward social media companies based on decisions about how or whether to use this information. 


From: 
Sent: Friday, October 23, 2020 9:51 AM 
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To: S cisa.dhs. gov>; isa.dhs. gov>; || 


20partnership.atlassian. net; 
@cisecurity.org> 
Subject: Case #CIS-MIS000062: Misinformation regarding trading in ballots at an in-person voting center 


CAUTION: This email originated from outsideof DHS. DO NOT click links or open attachments unless you recognize and/ortrust 
ithe sender. Contact your component SOC_with questions orconcems. 


Misinformation tweet regarding trading in ballots at an in-person voting center 


maryland. go 


ile >; ryland. go 
RD 1120yland cov piarvlaind eov>; 


Subject: Misinformation Report 


Please see the following screenshot below posted, 6 times, to our official Maryland State Board of Elections 
Twitter handle, [MJ at the following URLs. We have reported these tweets to Twitter for containing 
election misinformation. 


Maryland voters cannot surrender or trade-in ballots at in-person vote centers. Any voters who requested or 
received a mail-in ballot wanting to vote in-person will have to vote provisionally 
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HIDING INFO FROM VOTERS.TAKE UR MAIL IN WITH 


YOU TO THE POLLS, “SURRENDER” IT AND ASK FOR A 

REAL BALLOT....NOT A PROVISIONAL ONE. ALL VOTERS 
ARE FORCED TO VOTE PROVISIONAL UNLESSSSSS YOU 
TURN IN YOUR MAIL IN TO THE POLL WORKERS! IT'S A 
SCAM THEY DONT TELL YOU!DONT WANT U TO KNOW 


Thank you, 


Ajai 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution, or copying of this message and attachments is 


strictly prohibited. Please notify the sender immediately and permanently delete the message and any 
attachments. 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments. 
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EE 6 i ::27.com) 


From: 

Sent: 10/22/2020 3:46:12 PM 

To:  <'s2.¢hs cov) 

CC: Ee © itter.com); | | 
Subject: Re: FW: Case #CIS-MISO00058: Live canvass video on Twitter | 


CAUTION: This email originated from outside of DHS. DO NOT click links or open attachments unless you recognize and/or trust the 
sender. Contact your component SOC with questions or concerns. 


Thanks, nl We will escalate for review. 


Thanks, 
ie | 


On Thu, Oct 22, 2020 at 12:33 PM Scully, I is: 01s 20> wrote: 


Please see below report from Maryland. 


Thanks, 


The Cybersecurity and Infrastructure Security Agency (CISA) ef the U.S. Department of Homeland Security 
(DHS) is not the originator of this information. CISA“sMonyarding this information, unedited, from its 
originating source — this information has not been\ofigindted or generated by CISA. This information may also 


be shared with law enforcement or intelligengesagencies. 


CISA affirms that it neither has nor,sééks the ability to remove or edit what information is made available on 
social media platforms. CISA*makes»no recommendations about how the information it is sharing should be 
handled or used by social media companies. Additionally, CISA will not take any action, favorable or 


unfavorable, toward social media companies based on decisions about how or whether to use this information 


From: isecurity.org> 


Sent: Thursday, October 22, 2020 12:02 PM 


WB 9.dhs. gov>; ip.atlassian. net: 


isa.dhs. gov>; bo a 


ME ¢ isecurity.org> 
Subject: Case #CIS-MISO00058: Live canvass video on Twitter 


CAUTION: This email originated from outside of DHS. DO NOT click links or open attachments unless you recognize and/ortrust 
the sender. Contact your component SOC _ with questions orconcems. 
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Please see the report below from Maryland which includes an analysis from ZeroFox. Please also see the 
statement from the Montgomery County Board of Elections 
(https//twitter.com/md_sbe/status/13 19260743850708992). 


https://montgomerycountymd. gov/Elections/Resources/F iles/pd fs/Press°o20Release/2020/CNVSS ENG 1021 


20.pdf 


Best, 


Election Infrastructure Information Sharing and Analysis Center 
Center for Intemet Security 


www.cisecurity.org 
Follow us @CISecurity 


From: ryland. gov> 
Sent: Thursday, October 22, 2020 11:27 AM 
To ?, fbi. 

cisecurity.org>: i 

- Live Canvass Video on Twitter 


Please see the analysis from our social media’ monitoring vendor below regarding propagation of 
misinformation related to a video showing»ballot marking in a voting center in Montgomery County, MD. 


Please contact me if you have any questions. 


a------- -- Forwarded message #=----4- 
From: 
Date: Thu, Oct 22, 2020 at 1035 AM 
Subject: Re: Live Canvass Video on Twitter 
To: 


zerofox.com>, land. gov>, 


zerofox.com, rofox.com>, 


zerofox.com> 


r 


After additional analysis of this tweet as well as the networks of accounts retweeting it, we believe 
this content is likely being artificially spread by coordinated inauthentic behavior. The speed at which 
the video spread and the number of suspicious accounts that have retweeted the video are 
consistent with a coordinated inauthentic behavior rather than organic viral activity. It is likely that the 
coordinators of this activity were taking advantage of the livestream video opportunistically, rather 
than explicitly targeting the Maryland elections operations. 


MOLA_DEFSPROD_00007584 


Case 3:22-cv-01213-TAD-KDM GONE NNT ben 22 Page 19 of 111 PagelD #: 


We believe the origin of the video to be the tweet from es ter a ae een 
ns and received over 7,000 
retweets despite having less than 1,800 followers. Additionally, the J account 

is also responsible for a 
considerable amount of the content’s reach with more than 3,000 retweets albeit wi 
larger follower base in excess of 42,000 followers. The large number of retweets 
tweet received is abnormal compared to other tweeted content prior to the Montgomery County 
video Furthermore, these two accounts do not appear to follow each other, however, they have 34 
common followers, most of which display characteristics of inauthentic accounts. Automated or 
inauthentic behavior is generally characterized by: 


bly 
s 


u 


. Recently created 

e No profile image 

e Excessive use of emojis and hashtags in bios 

° Tweet counts not commensurate with account creation dates 


We recommend sharing the joint inauthentic accounts with your Federal law enforcement partners to 
cross-reference their data. We've also attached a list of the accounts commonly connected between 
and [Steet for further cross-reference. 


I's possible we could attempt takedown requests for.these two tweets that seemingly drove a lot of 
the reach with this video. Due to the characteristics of disinformation, its possible Twitter would be 
compelled to review the case carefully. However, there is at least some possibility that if these 
tweets are removed, it will be leveraged in disinformation suggesting censorship or further 
propagating conspiracy theories. 


Let us know if you would like us to take further action or conduct additional research. We will be sure 
to incorporate these findings into our EoW report for posterity. 


Thanks, 


On Wed, Oct 21, 2020 at 9:15 AM I 202 wrote: 
FYI 


On Wed, Oct 21, 2020 at 841 AM 


I sent 
times: 


ryland.gov> wrote: 
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BENG 


wana nenn- Forwarded message --------- 


Date: Tue, Oct 20, 2020 at 6:58 PM 

Subject: Re: Live Canvass Video on Twitter 

Ce maryland.gov>, fe 3a) 
EE 2200. cov>, i oar yiand.cov>, 
ee ntgomerycountymd. gov> 


Will interview this gentleman tomorrow 


Sent from my iPhone 


On Oct 20, 2020, at 626 PM, Rachel Rachfal -SBE- BE 0201200. 20> wrote: 


[EXTERNAL EMAIL] 


Please see the video ot I caassing i 


Montgomery County that has been liked and-shated”7,000 times alleging fraud. 


<image. png> 


Maryland State Board of Elections 


Bec 


Take 10 minutes to be counted now — visit: https://2020census.gov/ 


For COVID-19 Information and resources, visit: www.montgomerycountymd.gov/COVID19 
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Kind regards, 


[=] The linked image cannot be 


fea 


Kind regards, 


[x] The linked image cannot be 


a Mas 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is 
strictly prohibited. Please notify the sender immediately and permanently delete the message and any 
attachments. 
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fon ees 
Sent: 10/23/2020 10:28:40 AM 
cc: i@hq.dhs.gov] 
Subject: FW: Case #CIS-MISO00062: Misinformation regarding tradingin ballots at an in-person voting center 


Good morning, 


Nota Facebook issue, but wanted you to be aware. 


Brian 


Sent: Friday, October 23, z 


HM © 2020partnership.atlassian.net; cisecurity.org> 
Subject: Case #CIS-MISO00062: Misinformation regarding trading tn ballots at an in-person voting center 


CAUTION: TI This email origi nated from outside of DHS. DO NOT click OT click links or ts unless you recognize and/or trust the 
sender. Contact your component SOc with questions ‘or concerns. 


Misinformation tweet regarding tradingin ballots atan in-person voting center 


(ror: EE 2 iondcoe 


Sent: Friday, October 23, 2020 9:39 AM 
cisecurity.org: 


oag.state.md.us>; 


F 5 aryland.g 
q maryland.gov>| 
Imaryland.gov>; maryland.gov> 


Subject: Misinformation Report 


Please see the followingscreenshot below posted 6times to our official Maryland State Board of Elections Twitter 
handle, SR tthe following URLs. We have reported these tweets to Twitter for containing election 
misinformation, 


Maryland voters cannot surrender or trade-in ballots atin-person vote centers. Any voters who requested or received a 
mail-in ballot wanting to vote in-person will have to vote provisionally. 
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HIDING INFO FROM VOTERS.TAKE UR MAIL IN WITH 


YOU TO THE POLLS, “SURRENDER” IT AND ASK FOR A 

REAL BALLOT....NOT A PROVISIONAL ONE. ALL VOTERS 
ARE FORCED TO VOTE PROVISIONAL UNLESSSSSS YOU 
TURN IN YOUR MAIL IN TO THE POLL WORKERS! IT'S A 
SCAM THEY DONT TELL YOU!DONT WANT U TO KNOW 


Thank you, 


This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution orcopying of this message and attachmentsis strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 
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af i! 
twitter.com] 


mary Election Day 


Just to confirm what Brian said, Very quiet so far. Please let us know if any of the items passed to you today.are worth 
understanding further orif something changes. Thanks 


Department of Homeland Security 
Cybersecurity & Infrastructure Security Agency (CISA) 


(om TT 200 
Sent: Tuesday, June 2, R M 


To: = ae... 


Ce: twitter.com> 
Subject: RE: Primary Election Day 


_ 


It has been quiet on our end as well..As an FYI, we’re expecting to receive some info from Colorado about fake 
accounts. Will send along once | getit. 


-.: a call right now, $0 he may have more to add or a different perspective, but noissues on myend not doinga 
call. 


Regards, 


From: ‘witter.com> 
Sent: Tuesday, June 2, 2020 1:37 PM 


Ce: twitter.com> 


ender. contact your component Sade qliestionsé or concerns. 
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Hi a ...- wanted to checkin. 


We are tracking the curfew issues and have our legal team reviewing specific city-curfews in the key primary states. Our 
enforcementteams are prepared on the issue. 


We have received some escalations from external stakeholders, including the FBI. 


Things seem generally quiet -- soifit works ok for you -- let's plan to not meet today. Please just let us knowif 
anything comes up. 


On Mon, Jun 1, 2020 at 4:25 ME 2: c0 wrote 


dear i. hope youare well. 


We are preparing forelections tomorrow. Incase anything comes up urgently, please feel free to call me at 
or reach us viaemail. 


Should we plan to set up a mid-day checkin? Does 2:30 work for you? 


Thanks, 
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Sent: 11/6/2020 9:47:59 AM 
To: CFITF [cfitf@hq.chs.gov]; iT puma twitter.com] 
Subject: RE: FW: Are these real? 


| 


There are two reports inthis email chain. One of Facebook posts with videos the State believes are false (we are seeing 
if we can find someone to help confirm they are false as we don’t have that capability). That was the basis of the FYI for 
another group of folks. The specific report we are sharing with you all is the most recentlink toa Twitter post. The FYI 
does notapply to the Twitter portion of the chain (unless I’m misreading things, whichin my cur rent state is possible. 
We are not allowed to edit the reporting emails, soit creates some challenges for us when we’ re forwarding such 
reports. 


From: CFITF <cfitf@hq.dhs.gov> 

Sent: Friday, November 6, 2020 9:41 AM 
To: CFITF All <CFITFAII|@hq.dhs.gov> 
Subject: FW: FW: Are these real? 


From: 

Sent: Friday, November 6, 2020 2:40:46 PM (UTC+00:00) Monrovia, Reykjavik 
To: CFITF; 

Cc: HO twitter.com; [Otwitter.com; gov@twitter.com 
Subject: Re: FW: Are these real? 


Also, have PA state officials provided additional information to you on the authenticity of video orcircumstances 
underpinning it? It seems as if the correspondence flagging this issueto you said "FYI only at this point" and there isn't 
additional information from the state official, 


Thank you, 


On Fri, Nov6, 2020 at 9:35AM (MS tw itter.com>wrote: 


Thank you CFITF. We only see one URL linking to a video, but no attached screenshots as were referenced in the email. 
Please letusiknow ifthere are additional materials you would like us to review? 


Thanks, 


On Fri, Nov6, 2020 at 9:34 AM CFITF <cfitf@hgq.dhs.gov> wrote: 


Good morning Twitter — Please see the reporting below. 


Sent: Friday, November 6, 2020 9:19 AM 


Subject: FW: Are these real? 
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See more below from PA. have we heard anything? 


Frorn I 2 20v> 
Sent: Friday, November 6, 2020 9:16 AM 


Subj eseredl: 


CAUTION: This email originated from outside of DHS, 
the sender, Contact your component SOC with question’ 


Here’sa little more. Any word on yourside? Wejust got a request from areporter. We know the one on our page was 
taken down, butit appears there are morefloating out there. 


Sent: Friday, November 6, 2020 6:29 AM 


To 
Cc: 
Subje: re these real 


I think | found a version of the video: https://twitter.com/StateofusAll/status/1324556436135882753 
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Sent: Friday, November 6, 2020 3:35 AM 


Cc: © 02.0 © 02.20V> 


Subject: RE: Are these real? 


Thank you for the notice. If you got screenshots or links can you send those? 


(rom © 2.200> 
Sent: Friday, November 6, 2020 12:01 AM 


(ci © 02.:0> i © 03.20v> 


Subject: Fwd: Are these real? 


FYI only at this point 


For; IS 2.201 
Sent: Thursday, November 5, 2020 11:36 PM 
To A OHS) 


Subject: Re: Are these real? 


The only guess | haveis, ifthis is real, they took live feed from “remaking” damaged ballots. | just have noidea where 
this might have comefrom... 


From: i p3.cov> 
Sent: Thursday, November 5, 2020 11:22:52 PM 
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To: EE 0s) I oho. chs.cov> 


Subject: Are these real? 


Sorry to message late, but was going through the dos page and comments (old habits from EAC die hard) and came 
across these posts. Sorry to screenshot, butif you goto our page you should be able to see the comments on the post 
and go to the pages. 


Are these making their way around the internet? Because there is no polling place | know of that hasoverhead 
cameras. Just don't want another "burning ballots" fake thing spreading. 


Apologies for sending to you all first, but! didn’t want to call an all hands meeting here when some of our folks are 
getting their first few real hours rest since Monday. 


Thanks, 
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Sent; EE PM 
To: om] 


Subject: FW: Case #CIS-MISO00072: Misinformation comment on Marion County, OR Facebook page 
Attachments: 72.PNG;72_2.PNG 


From: Misinformation Reports <misinformation @cisecurity.org> 


Sent: Monday, October 26, 2020 6:38 PM 
To: I 3 i: cov>, CISA Central <central @cisa.dhs.gov>; CFITF <cfitf@hq.dhs.gov>; 


tips@2020partnership.atlassian.net; Misinformation Reports <misinformation@cisecurity.org> 
Subject: Case #CIS-MISO00072: Misinformation comment on Marion County, OR Facebook page 


Misinformation comment posted on Marion County, OR Facebook page. Screenshots of original post, comment, 
and Marion County's response to the commentare attached. 


From: IIE o,arion.or.us> 
Sent: Monday, October 26, 2020 6:19 PM 
To: Misinformation Reports <misinformation@cisecurity.org> 


Cc: TE -o.marion.cr.us>; iE co.marion.or.us>; 


Subject: Facebook Comment 


| was asked to forward theyattathed Facebook comment we received on the Marion County Facebook page. Included 
is the comment along with our response. Please let me know if you need any additional information. 


Thanks, 


Marion County | 
a a aa ae | 
Facebook: facebook.com/MarionCountyOR | Twitter: @MarionCo_Board 
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This message and attachments may contain confidential information. Ifit appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notifythe senderimmediately and permanently delete the message and any attachments. 
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>\ Follow @Share [fl Save 


Already voted; though some have made mention they 
wi cause they,got thewrong ballots and now suddenly 


the election office is “out of ballots”’So many oregonians won't be 
able to vote as promised. 
| don't care wh you'ré\oting for, this is just wrong! 


Like - Reply” 1d 


PrAuthor 
E Marion County, Oregon Sa We have 
Marion County, Gonfirmed with the Marion County Clerk's Office that there are 
Sufficient ballots for every voter that needs a replacement. 
Oregon They are still mailing ballots daily. The Senator Hearing Room 
@MarionCountyOR (located at Courthouse Square, 555 Court St. NE, Salem) is 
now open for anyone that needs to come in for a replacement 
Home ballot. 


Like - Reply 17m 
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Marion County, 


Oregon 
@MarionCountyOR 


Home 
About 
Photos 
Events 
Videos 

Join My List 
Posts 
Groups 


Community 


2 Page | 


2781 
3\ Follow Share & Save 


Marion County, Oregon as 
cy «3 


Watch for mail-in ballots soon — ballots were mailed Oct. 14. )Displaced by 
wildfires, click to find out how to get a ballot and vote! a. 
https:/Awww.co.marion.or.us/.../.../Pages/Displacéd-Voters.aspx 


Ballots are on their way 
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Sent: 10/1/2020 5:00:19 PM 
To: ES 0 <0 |; es com] 
Subject: FW: Case#CIS-MIS000024: Misinformation re:Sonoma County elections - Promoted by Russian Actors 


Good afternoon a. CE 


This is not Facebook related reporting, but thought it would be of interest to yourteam. 


Regards, 


From: Misinformation Reports <misinformation@cisecurity.org> 

Sent: Thursday, October 1, 2020 4:23 PM 

To: HR isa. chs.gov>; CISA Central <central @cisa.dhs.gov>; CFITF<cfitf @hqidhs.gov>; 
Misinformation Reports <misinformation @cisecurity.org> 

Subject: Case #CIS-MISO00024: Misinformation re: Sonoma County elections - Promoted by Russian Actors 


We know many are already aware of this case but the impactse@ems to be escalating. Our hope is the platforms cando 
more to take down the misinformation. The EIP has beemtracking thisspread under ticket EIP-243 and has more 
examples, 


Thanks, 


Fromm s0.ca.gov> 


Sent: Thursday, October 1, 2020 4:14PM 
To: Misinformation Reports<misinformation@cisecurity.org> 
Subject: Misinformation re: Sonoma County elections - Promoted by Russian Actors 


Hello, 


My name is  |'m the a the California Secretary of State Office 
of Election Cybersecurity. 
My email address is 0s. <o.20v. 


We've been monitoring a situation in our state where an image of ballots was circulated as evidence of voter 
fraud - Sonoma County has explained that this was part of a routine process to discard old 2018 ballots, as 
allowed by law, and has nothing to do with the 2020 election. 
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https://twitter.com/darhar981/status/130953 3853967671297 

Debunked 

here: https//Awitter.com/CountyofSonoma/status/1309588979545645056?ref_sre=twsrc%5 Eifw%7Ctweamp% 
SEtweetembed%7Ctwterm%5S E1309588979545645056%7CtwereSEshare 3&ref_url=https%3 A%2F %2F obse 
rvers.france24.com%2Fen?2F 2020100 1-debunked-viral-photos-mai|-ballots-california-dumpster 


While all posts around this topic are misinformation, we were justalerted to the fact that Russian Actors 
Amplified False Claim of Mail-in Ballots Discarded in Sonoma County Dumpster 


On Oct. 1, 2020, Reuters and the security firm Graphika reported that actors associated with the St, 
Petersburg-based Internet Research Agency (IRA) established a pseudo news site called the Newsroom for 
American and European Based Citizens “NAEBC” (naebc[.Jcom) which attempted to influence.U'S. voters 
ahead of the 2020 Presidential election. 


It was observed that on Sept. 25, 2020, the NAEBC-associated fT. the platform 
Parler amplified the false narrative that mail-in-ballots were recently found in a dumpsterin Sonoma County. 
EEE 00s'cc 


“More than a thousand mail-in-ballots found in a dumpster in California! Thezip code “94928” on the ballots 
matches the county. This is why everyone should vote in person! #MAGA2020#TRUMP2020#KAG" (Figure 
1). 


We consider [EE post as evidence that Russian actors.are amplifying reports of mail-in ballots 


. In addition to reposting articles from U.S.-based news outlets, DE ce posted articles 
from the NAEBC website, with the mostrecent NAEBC post on Oct. 1, E 

. This is an indication thats Closely affiliated or operated by the same actors who set up 
the NAEBC website. 


. Our assessment that Russian actors are amplifying mail-in ballot errors and disinformation is consistent 
with American intelligence officials recent assessments, as reported by 
. Representative Adam B. Schiff, chairman of the House Intelligence Committee. 


Our monitoring software is investigating other NAEBC-affiliated accounts for potential investigatory leads into 
additional Russianinformation operations and any impact to California voters. 
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&l ‘The linked Image cannot be displayed. The file may have been 
moved, renamed, or deleted. Verify that the link points to the correct 
file and location. 


Figure + FREE empires a false mail-in ballot narrative; the narrative’ was subsequently debunked as 
the mail-in ballots seen in the photo were from 2018 


This message and attachments may contain confidential information. ifit appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying ofthis message and attachmentsis strictly prohibited. 
Please notify the senderimmediately and permanentlydeletethe message and any attachments. 
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From: (TH | /0= © CHANGELABS/OU=EXCHANGE ADMINISTRATIVE GROUP 
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=7C A10604AEE04B1D ABS3DC9F88413080 {J 
Sent: 10/29/2020 7:30:38 PM 


To: ee 


ERE twitter.com) 
cc: CFITF [cfitf@hq.dhs.gov]; misinformation @cisecurity.org 
Subject: FW: Case #CIS-MISO00091:alleged fraud in Washington state elections 


Good evening, 
Please see the belowreport from Washington. 


Thanks, 


The Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security 
(DHS) is not the originator of this information. CISA is forwarding this information, unedited, from its 
originating source — this information has not been originated or,generated by CISA. This information may also 
be shared with law enforcement or intelligence agencies. 


CISA affirms that it neither has nor seeks the ability to remover edit what information is made available on 
social media platforms. CISA makes no recommendations about haw the information it is sharing should be 
handled or used by social media companies. Additionally, CISA will not take any action, favorable or 
unfavorable, toward social media companies basedon decisions about how or whether to use this information. 


In the event that CISA follows up to request further information, such a request is not a requirement or demand. 
Responding to this request is voluntaryand CISA will not take any action, favorable or unfavorable, based on 
decisions about whether or not to respond tothis follow -up request for information. 


From: Misinformation Reports <misinformation @cisecurity.org> 

Sent: Thursday, October 29, 2020 7:26 PM 

To: EE © cisa.dhs.gov>; CISA Central <central @cisa.dhs.gov>; CFITF <cfitf@hq.dhs.gov>; 
tips@2020partnership.atlassian.net; Misinformation Reports <misinformation@cisecurity.org> 

Subject: Case #CIS-MIS000091: alleged fraud in Washington state elections 


Misinformation report: two tweets alleging fraud in Washington state elections. 


From: i ©sos.wa.gov> 
Sent: Thursday, October 29, 2020 7:21 PM 
To: Misinformation Reports <misinformation@cisecurity.org> 


(TL sos. 2.¢0v> is © sos. wa cov 
EEE 0s. wa. gov> 


Subject: Possible misinformation on Twitter 
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Hello, 


| wanted to flag two tweets with possible misinformation about the election. 


https://twitter. com MY status/132173825739953357 1 -- “Ballots can appear whenever, from whomever” is 


false. 


https://twitter. corn III tote/1322759077508908033 -- The response to the above tweet includes the following 
sentence: “Washington State In 2004 judges ignored the real count and rewarded the Democrats.” Thatis not a factual 
statement. 


My name z=! and |'m an for the Washington Office of the Secretary of State. | can be 
reached viathis email orthe number listed in my signature block below. My cell phone is monitorediafter hours ifl need 
to be reached urgently. 


| am also copying Washington State Elections Office of the Secretary ofstate 
ee | EES 


Please let me knowif you have any questions or need additional information. 


Thank you. 


This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 
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6 5, <0) 


10/26/2020 6:58:26 PM 
ME is2.chs.c0v] 


SE £0.07; © £.com]; CFITF [cfitf@hq.dhs.gov] 


Re: Case #CIS-MISO00072: Misinformation comment on Marion County, OR Facebook page 


ICAU i ON: TI is email originated from outside of DHS. Do NOT click links or open attachments unless you recognize and fortrust the — 
sender. Contact your component SOC with questions or concerns. _ (oe | 


Thanks! 


FACEBOOK 


From SE © jsa.dhs.gov> 

Date: Monday, October 26, 2020 at 6:57 PM 

10: © f.com> 

Cc: © b.com>, i ©fb.com>, CFITF <cfitf@hq.dhs.gov> 
Subject: FW: Case #CIS-MISO00072: Misinformation comment on Marion County, OR Facebook page 


Oops...sorry about that. Here you of 


From: Misinformation Reports <misinformation @cisecurity.org> 

Sent: Monday, October 26, 2020 6:38 PM 

To saidhs.gov>; CISA Central <central @cisa.dhs.gov>; CFITF <cfitf@hq.dhs.gov>; 
tips@2020partnership.atlassian.net; Misinformation Reports <misinformation@cisecurity.org> 

Subject: Case #CIS-MISO00072: Misinformation comment on Marion County, OR Facebook page 


Misinformation comment posted on Marion County, OR Facebook page. Screenshots of original post, comment, and 
Marion County's response to the commentare attached. 


From III? co.marion.or.us> 
Sent: Monday, October 26, 2020 6:19 PM 
To: Misinformation Reports <misinformation@cisecurity.org> 


Cc RG co.ma rion or.us> TS co. marion.or. us> ER © oregon gov; 
MEE or eg0n.gov 


Subject: Facebook Comment 
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| was asked to forward the attached Facebook comment we received on the Marion County Facebook page. Included is 
the comment along with our response. Please let me know if you need any additional information. 


Thanks, 


This message and attachments may contain confidential information. Ifit appearsthatthis mess age was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited, 
Please notify the senderimmediately and permanently delete the messageand any attachments. 
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om II f.<0:) 
Sent: 5/4/2022 3:48:11 PM 
To: I <2 20%1 


cc: Se — 
I ¢15 dhs.go 


Subject: Re: Account Security 


HelloTeam CISA! 

Hope you are all well 

In our conversation afew weeks ago, you mentioned that your team could potentially help connect us with local 
election offices. ls this something you are still able to help with? Additionally, we can provide atraining forthemon 
account security best practices if you think that could be helpful. 


Andas always, if there is anything we can doto be helpful inthe meantime, please letUs know! 


Thanks 


From i © cisa.dhs,gov> 


Date: Wednesday, April 27, 2022 at 12:37 PM 


a ——— EL — = 
Cc! @cisa.dhs.cov>, 


<E cis2.chs 20.>, I 
< R@ cis dhs gov> 


Subject: Re: Account Security 


Perfect thank you so much! 


[x] The linked 
image 
cannot be 
displayed. 
The file may 
have been 


mowed ra 


From: |(@fb.com> 
Sent: Wednesday, April27, 2022 11:15:25 AM 


10 i © cis2.dhs <0v> iM © fo com 
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Cc} 


<sa.chs ov lI 0 c:2.dhs20v> 
fb.com> i” ©f.com>) 
cisa.chs.cov> 


Subject: Re: Account Security 


Got it—and no problem! | had ourteam design my email directlyinto the document (newversion attached here) so 
everythingis all in one place foryou. 


Best, 


Meta 


Fron: © cisa.dhs.gov> 
Date: Wednesday, April 20, 2022 at 12:45 PM 


0 sco, 


cisa.dhs 60v>, © cisa.chs.cov> ay 
MR @ c's. dhs.gov> 


Subject: RE: Account Security 


Hifi that could work, though we’d alsowelcome that as part of the document. Given we have a broader team that 
does trainings etc, it might be he! pful for thatinfo to be includedin the doc. Though | understand there may be concerns 
with this approach. 


Will take yoursteer, let me know what you think. 


From: | com> 


Sent: Monday, April 18, 2022 5:30 PM 
re com 
dhs.gov>; cisa.dhs.gov>; 


ee com>; fb.com>; 
@fb.com>: com>} cisa.dhs.gov> 
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Subject: Re: Account Security 


= 


Would it work to just provide my email when you share out this one pager, and let them knowif they need anything (like 
a page verification) or have any content they want to escalate for review, theycan reach out to me and | can get themto 
the right person tohelp? 


Best, 


OOMeta 


‘om: I 10 com> 


Date: Monday, April 18, 2022 at 11:50 AM 
To cisa.dhs.gov> 
Cc; 


—_ 


cisa.dhs.gov>, i ©fb.com> 
@fb.com>, @fb.com>, fb.com>, 
fb.com>, @cisa.dhs.gov>, ES cisa.dhs.gov>, 


@cisa.dhs.gov> 


Subject: Re: Account Security 


Great! Many thank for the quick reply.& feedback 
HE who is cc’d on our team will loop imothetsfrom her team 


Happy to move some of your colleagues to BCC as needed/defer to you to do that aff eno her team work out the details. 


Sent from my iPhone 


On Apr 18,2022, 2110: oss gov wrote: 
Thanks so nuch forsending 


This looks great — the only thing I’d recommend adding is any steps for flagging or escalating MDM content, if possible. | 
think then that would make this a comprehensive product on both of the critical needs for officials account security 
and MDM concerns. We discussed this a bitin our in-person meeting two weeks ago. Let me knowif that’s doable. 


Thank you! 
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From © fb.com> 


Sent: Friday, April 15, 2022 9:01 AM 


1: i © <2: :0v> i © c's.chs.cov>; 


I 6 is 2.chs.cov> 
Cc; fb .com>; f.com>; 


@fb.com>;| fb.com> 


Subject: Account Security 


CAUTION: This email originated from outside of DHS. DO NOT click links or open attachments unless you recogni and/or trust the 
sender. Contact your component SOC with questions or concerns. 


Good Morning! 
As discussed during our meeting last week, | wanted to share our account security docthat We’ve been working on. 
We would be grateful for any feedback and would be happy to set up a call to discuss. | am includin, who 


you met during our meeting & are helpingimplement these procedures with key stakeholders. Also, 
schedule acallto discuss, if helpful. 


Many thanks for your collaboration & best fora great weekend! 
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BR 2 «i :22r.com) 
1/7/2021 10:58:39 PM 
Misinformation Reports [misinformation@cisecurity.org] 


EE © <is2.6hs gov); gov@twitter.com 


Re: FW: Election Related Misinformation 


ro 


sender, conte jour eepsten Sot Niuean or concerns. _ 


Thank you, = Both Tweets have been removed from the service. 


Thank you, 

On Thu, Jan 7, 2021 at 3:53 MI ce: com> wrote: 
Thank you, a We will escalate. 

Thanks, 


On Thu, Jan 7, 2021 at 3:44 PM Misinformation Reports <misinformation@cisecurity.org> wrote: 


Hy I witter, 
Please see this report below from the Arizona SOS office. Please let me know if you have any questions. 


Cc S| I am not sure the best contact email to Send this to at Twitter. 


Thanks, 


From: SN © 2250s.c0v> 

Sent: Thursday, January 7, 2021 3:26 PM 

To: Misinformation Reports <misinformation@cisecurity.org> 

Cc: I © 22:0; cov>; mmm © azs0s 20v> 
Subjects, Election, Related Misinformation 


Hello, 


['m QR communications director for the Office of the Arizona Secretary of State. 


Iam flagging this twitter account for your review. ct 
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https//twitter.co: 
- wd 

y What are you hiding? 
@ Home 7 

Ib Fishasud 
# Explore ITN) sone _ 
& notifications Tate re in 
Messages vs hah 
Bookmarks ise ou 
BD tists - FP 
& Profile a” What are you hiding? ——] 
© More What's happening 


on oo 
ae al ace al 
——es——) ethno nao 
pore 


Gotgshae 


Of specific concern_to the Secretary of State are the following tweets: 

status/134645 1683384160257 

istatus/1346233687 160008704 

lsely assert that the Voter Registration System is owned and therefore operated by 


Reason: These messages 
foreign actors. 
This is an attempt to further undermine confidence, in the election institution in Arizona 


Thank you for your consideration in reviewing this matter for action. 


Sincerely, 


This message and attachments may contain confidential information. If it appears that this message was sent 
to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is 
strictly prohibited. Please notify the sender immediately and permanently delete the message and any 
attachments. 
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Misinformation Reports [misinformation @cisecurity.org] 
11/11/2020 6:07:35 PM 
gov@twitter.com 


CISA Central [central @cisa.dhs.gov]; CFITF [cfitf@hq.chs gov]; io cisa.dhs gov); 


Misinformation Reports [misinformation @cisecurity.org] 
Fwd: Case #CIS-MISO00196: allegations of election fraud 


Twitter, 


Please see belowa Misinformation Report submitted by the Kentucky Secretary of State offices 
Because today is a holiday, we are forwarding this report directly to you. 


Election Infrastructure Information Sharing and Analysis Center 


Center forInternet Security 


Email: misinformation @cisecurity.org 
Www.cisecurity.org 


Begin forwarded message: 


From: Misinformation Reports <misinformation @cisecurity.org> 
Date: November 11, 2020 at 4:49:18 PM EST 


(of 's2.0°5:204-, cisACentral <central@cisa.dhs.gov>, CISA CFITF <cfitf@hq.dhs.gov>, EIP 
<tips@2020partnership.atlassian.net>, Misinformation Reports <misinformation@cisecurity.org> 


Subject: Case #CIS-MIS000196: allegations of election fraud 


Twitter account alleging election fraud: htt ‘twit xe) 


ror hy cov> 

Sent: Wednesday, November 11, 2020 4:28 PM 

To: Misinformation Reports <misinformation@cisecurity.org> 
Subject: Missinformation 


This useris pushing miss information about election fraud that does not exist. looking at the entire accountit looks like 
bot trolling activity if not an out right disinformation account. 
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Get Outlook forios 
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¢ 
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a ON 


®) Follow ) 


Fight for the things that you care about, but do it 
in a way that will lead others to join you - RBG 
#Resist #StrongerTogether #FBR 


6,777 7,140 


Tweets 


KENTUCKY NEEDS TO BE 
INVESTIGATED 

BALLARD - McConnell won by 74.64% of 
4.2k votes - that's roughly 3,134 people. 
Ballard county has 2,285 registered 
republicans as of 10/10/2020 

@ @ 

#VoterSuppression 

1/4 


US Senate: Kentucky results 
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This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments. 
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1 


11/11/2020 12:11:52 AM 


isa.dhs.gov] 
twitter.com]; jitter.com]; Twitter Government & Politics 
[gov@twitter.com]; CFITF [cfitf@hq.dhs.gov]; Misinformation Reports [misinformation @cisecurity.org] 
Re: FW: Case #CIS-MISO00195: allegations of election fraud with Dominion voting equipment in WA state 


Thank you. All Tweets have been labeled, with the exception of two from @SeattleSuze. Those two Tweets 
were not found to violate our policies. 


a 
On Tue, Nov 10, 2020 at 7:25 > £4 wrote 
Thanks, ME We will escalate 


On Tue, Nov 10, 2020 at 7:23 PI 
Good evening Twitter, 


isa.dhs. gov> «wrote: 


Please see the below report from Washington. 


Thanks, 


The Cybersecurity and Infrastructure Seeurity Agency (CISA) of the U.S. Department of Homeland Security 
(DHS) is not the originator of thisinformation, CISA is forwarding this information, unedited, from its 
originating source — this information has not been originated or generated by CISA. This information may 
also be shared with law enforcement or intelligence agencies. 


CISA affirms that it neither has nor seeks the ability to remove or edit what information is made available on 
social media platforms. CISA makes no recommendations about how the information it is sharing should be 
handledor used bysocial media companies. Additionally, CISA will not take any action, favorable or 
unfavorable, toward social media companies based on decisions about how or whether to use this 
information. 


In the event that CISA follows up to request further information, such a request is not a requirement or 


demand. Responding to this request is voluntary and CISA will not take any action, favorable or unfavorable, 
based on decisions about whether or not to respond to this follow-up request for information. 


From: Misinformation Reports <misinformation@cisecurity.org> 
Sent: Tuesday, November 10, 2020 7:17 PM 
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‘ToS cisa dhs cov>; CISA Central <central@cisa.dhs.gov>; CFITF 


<cfitf{@hq.dhs. gov>; 20partnership.atlassian.net; Misinformation Reports 
<misinformation@cisecurity.org> 


Subject: Case #CIS-MIS000195: allegations of election fraud with Dominion voting equipment in WA state 


Misinformation report: twelve (12) tweets alleging election fraud with Dominion voting equipment in 
Washington state. 


uesday, November 10, 2020 7:03 PM 


To: Misinformation Reports <misinformation@cisecurity.org> 
Cc sOS.wa. gOV>; 0S. Wa. i 


Hello, 


I wanted to flag the following tweets that include misinformation and/or false allegations of election fraud. 
There is no evidence to back any of these claims. There have been no reports or indications of fraudulent 
activity in Washington state for the:2020 general election. 


Franklin County is the onlyseounty in Washington state that uses a version of Dominion software and 
hardware. The system in use has.been certified, and we are not aware of any issues. 


No counties in Washington state use GEMS 


Additionally, each county conducts post-election audits in the days after the election that are publicly 
observable, which provides another layer of protection to ensure the results they certify later this month are 
accurate. At the end of the certification period, each county will publish a reconciliation report that discloses 
details aboutall of the ballots issued, received, counted, and rejected during this election. 


https//twitter.com/LuyMyCountry7/status/1326303394 147921920 


https/twitter.com/seattleSuze/status/1326208987348398080 


https/twitter.com/seattleS uze/status/1326209828717436928 
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https/twitter.com/MatthewMacp hel 7/status/1326212450585210880 


https//twitter.com/MatthewMacp he17/status/1326211588089470976 


https//twitter.com/MatthewMacp he 1 7/status/1326204530543882240 


ittps//twitter.com/MatthewMacp hel 7/status/1326202866567049216 


https//twitter.com/Katrina64718085/status/13263 11025738575872 


ittps/twitter.com/Maga2020Rules/status/1326187323566948352 


https//twitter.com/lazalere/status/1326082445 196681216 


https/twitter.com/TerenaHimpel/status/1326006222034665472 


https//twitter.com/LolaT welve/status/132593494 1503250433 


My name is x= .38 and I’m iii” for the Washington Office of the Secretary of 
State. I can be reached via this email my signature block below. My cell phone is 


monitored after hours if I need to be reached urgently. 


Tam also copying Washington State Elections NM Office of the Secretary of State 
Communications Director i. and our Web and Social Media Coordinator aie 


Please let me know if you have any questions or need additional information. 


Thank you. 
=) 


Office of the Secretary of State 


@)S t f Stat 
(g)Secretary o BS Sil 
BOB 
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This message and attachments may contain confidential information. If it appears that this message was sent 
to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is 

_ strictly prohibited. Please notify the sender immediately and permanently delete the message and any 
attachments. 
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fo.com] 
11/10/2020 12:17:57 PM s 
Misinformation Reports [misinformation@cisecurity.r¢), so chs gov; CISA Central 
[central @cisa.dhs gov]; CFITF [cfitf@hq.dhs.gov]; tips @2020partnership.atlassian.net 
Re: Case #CIS-MIS000192: allegations thata deceased person voted in Monona County, lowa 


less you recognize and/or trust the | 
chet bes a SL 


pre a 


This case has been closed out and the Secretary of State’s office has been informed. Thanks! 


From: Misinformation Reports <misinformation@cisecurity.org> 

Date: Monday, November 9, 2020 at 5:29 PM 

To: EE <isa.dhs.gov>, Central CISA <central@cisa.dhs.gov>, "cfitf@hq.dhs.gov" 
<cfitf@hq.dhs.gov>, "tips@2020partnership.atlassian.net" <tips@2020partnership.atlassian.net>, 
Misinformation Reports <misinformation@cisecurity.org> 

:: TT com> 

Subject: Case #CIS-MISO00192: allegations that a deceased person voted.in Monona County, lowa 


He EIP, we have included Facebook in this report, 
Misinformation repot: Facebook post that a deceased person votedin Monona County, lowa 


https://www.facebook.com/amy zeitler 


Fro: 0 s,iowa, goV> 


Sent: Monday, November 9, 2020 6:05 PM 

To: Misinformation Reports <misinformation@cisecurity.org> 

Cc: a os. owa gov>; ne s°s.iowa.gov> 
Subject: RE: Facebook post 


Slight correction oninformation from below. The voter's record was cancelled due to his death on 10/05/2009, NOT in 
1999, 


From ae 


Sent: Monday, November 9, 2020 5:02 PM 


Subject: FW: Facebook post 
Good afternoon, 


We received this email from alocal election official about a FB post saying a deceased person voted, Attachedisascreen 
shot of the post along with a scanned copy of the voter's cancelled VRrecord. 


From sos.iowa.gov> 


Sent: Monday, November 9, 2020 4:30 PM 
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To: os.iowa.gov> 


Subject: FW: Facebook post 


Are you reporting these oris comms? 


From: i 10nonacounty.org> 
Sent: Friday, November 6, 2020 9:10 AM 


To: cyber<cyber@sos.iowa.gov> 
Subject: Facebook post 


Good Morning, 


| reached out tht Secretary of State’s office and he informed me to get this information to you, | receiveda 
complaint about a Facebook post that implies a deceased person had voted. | have attached the post from Facebook and 
my record from | Voters to show you that the person is deceased and has been acanceled vote since 8/18/1999. We 
also do not havea precinct named ON204. My office received a call from this person’s mother yesterday and she was 
upset. I then had another citizen come into my office wanting to know how this was posted on Facebook. We received 
another phone call this morning from the step father wanting to know how this is happening. | hope that you can assist 
with this matter. 


Monona County Auditor & 
Commissioner of Electiony 
610 Ioww Ave 

Onawa, IA 51040 


ME 01 rcounty.orgy 


“Believe you can and you're halfway there.” - Theodore Roosevelt 


This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 
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twitter.com] 
11/6/2020 12:15:08 PM 
cisa.dhs.gov] 
hq.dhs.gov] 
: Are these real? 


and/or trust the | 


Thank you so much! We have applied a label to the Tweet 


Thanks, 


On Fri, Nov 6, 2020 at 11:58 AM a 2 :s2.18s.20.> wrote; 
Hey i 


Just came across this debunk of the video on Twitter -- 
https:/witter.com/JaneLytv/status/ 13247561 17415776257?s=20. 


From: ) twitter.com> 


Sent: Friday, November 6, 2020 9:53 AM 


Thanks, We recognize ‘the PA Secretary of State might be busy at this moment. I am happy to escalate 
now without waiting for additional information. 


Thanks, 
On Fri, Nov 6, 2020 at 9:51 AM RR © is2.c0s.cov> wrote: 
i 


There are two reports in this email chain. One of Facebook posts with videos the State believes are 
false. That was the basis of the FYI for another group of folks. The specific report we are sharing with you 
all is the most recent link to a Twitter post. The FYI does not apply to the Twitter portion of the chain (unless 
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I’m misreading things, which in my current state is possible). We are not allowed to edit the reporting emails, 
sO it creates some challenges for us when we’re forwarding such reports. 


On the video’s authenticity, PA states in the very first email that they believe the video’s are false. We are 
reaching out to partners to validate. Not sure we'll be able to get a validation, but can certainly pass along 
anything we get back. 


Not sure this is helpful, so happy to chat if you'd like. 


From: BE ots ov 
Sent: Friday, November 6, 2020 9:41 AM 
To MIRAI 0. cis sov> 


Subject: FW: FW: Are these real? 


r 6, 2020 2:40:46 PM (UTC+00:00) Monrovia, Reykjavik 


twitter.com; HE? twitter.com; forwitter.com 


Subject: Re: FW: Are these real? 


Also, have PA state officials provided additional information to you on the authenticity of video or 
circumstances underpinning, it? It seems as if the correspondence flagging this issue to you said "FYI only at 
this point" and there isn't additionalvinformation from the state official. 


Thank you, 


On Fri, Noy 6):2020'at 9:35 AM 2 't1er.com> wrote: 


Thank vou A We only see one URL linking to a video, but no attached screenshots as were referenced 
in the email) Please let us know if there are additional materials you would like us to review? 


Thanks, 


On Fri, Nov 6, 2020 at 9:34 AMBRE to cs. cov> wrote: 


Good morning Twitter — Please see the reporting below. 
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Sent: Friday, November 6, 2020 9:19 AM 


Subject: FW: Are these real? 


See more below from PA. have we heard anything? 


Department of Homeland Security 
Cybersecurity & Infrastructure Security Agency (CISA) 


From: i@pa.gov> 


Sent: Friday, November 6, 2020 9:16 AM 
Subject: Fwd: Are these real? 


pen attachments unless you recognize and/or — 


Here’s a little more. Any word on your side? We just got a request from a reporter. We know the one on our 
page was taken down, but it.appears there are more floating out there. 


PA Department of State 


a 
Subject: : - a ¥ 
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I think I found a version of the video: https//witter.com/StateofusAlI/status/1324556436135882753 


3:35 


Sent: Friday, November 6, 2020 AM 


Thank you for the notice. If you got screenshots or links can you send those? 


ipa.gov> 

iday, November 6, 2020 12:01 AM 

@ pa. go 

Ce @pa. 
Subject: Fwd: Are these real? 


FYI only at this point 


PA Department of State 


From: @pa.gov> 
Sent: Thursday, November 5, 2020 11:36 PM 
To: (DHS) 

Subject: Re: Are these real? 


The only guess I have is, if this is real, they took live feed from “remaking” damaged ballots. I just have no 


idea where this might have come from. 


PA Department of State 
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809 
Sent: Thursday, November 5, 2020 11 2 PM 


[oA FS) ION. 


Subject: Are these real? 


Sorry to message late, but was going through the dos page and comments (old habits from BAQ»die hard) 
and came across these posts. Sorry to screenshot, but if you go to our page you should be able to see the 
comments on the post and go to the pages. 


Are these making their way around the internet? Because there is no polling :place)I know of that has 
overhead cameras. Just don't want another "buming ballots” fake thing spreading 


Apologies for sending to you all first, but I didn’t want to call an all.hands meeting here when some of our 
folks are getting their first few real hours rest since Monday. 


Thanks, 
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fb.com] 
11/3/2020 7:07:19 PM 
Misinformation Reports [misinformation @cisecurity.or¢] iis © cisa.chs gov] 
cisa.dhs gov], hq.dhs.gov]; /2020partnership.atlassian.net 
Re: Case #CIS-MISO00142: Voter in Ml alleges submitting 300 ballots 


Ns Or concerns. _ - | 


pee Be NOT ee ifukseroperfetanlmentemnessyauyewwanze are oreistiie| 


Thank you for including me, I'm moving this through our processes now. I'll update you when | have more 
information. 


Best, 


From: Misinformation Reports <misinformation@cisecurity.org> 
Sent: Tuesday, November 3, 2020 5:52 PM 


To: |@cisa.dhs.gov>; cisa.dhs g0v>i@hq.dhs. gov 
hq.dhs.gov>; 2020partnership.atlassian.net (@2020partnership.atlassian.net>; Misinformation Reports 


<misinformation@cisecurity.org> 
Cc; ifb.com> 
Subject: Case #CIS-MISO000142: Voterin MI alleges submitting 300/ballots 


i ———> | we have included Facebook in this report. 


Misinformation report: citizen alleges on Facebook that he submitted 300 ballots 


https://www.facebook.com/profile. php?id=%576601744 
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Posts 


f@ Photos ® Life Events 


Gotta tell ya seriously | had at least 300 Ballots show up 


to my rental properties from 20 years worth of past 


tenants ./! sent all in with straight Republicans ticket. 
Voter fraud is real .. sorry but that’s the way it is and I'll 
fight back .. it will only look like these people voted twice 
Find that lol if they even vote .. my points is | voted for 


300 people cuz | had their ballots .. Trump 2024 


It's Election Day. Go to the Voting 
Information Center for important info 
and updates. 

Get Election Day info 


#0 Ap ni 


From: MS-ISACSOC 

Sent: Tuesday, November 3, 2020 6:39.PM. 

To: Misinformation Reports <misinformation@cisecurity.org> 
Cc; MS-ISAC SOC JO msisac.org> 

Subject: FW: Michigan VoterMisinformation//Facebook 


Please see below, Thanks. 


; Arey the maturity of your 
CRE cybersecurity program. 
Seal Register for the NCSR today! 


m 


24x7 Security Operations Center 
cisecurity.org - 


Multi-State Information Sharing and Analysis Center (MS-ISAC) 
lection Infrastructure Information Sharing and Analysis Center (E-ISAC) 
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Ms-ISAC* ~<A. Elections 
Multistate information * Infrastructure 
Sharing & Analysis Center* ISAC 


0000 


Sent: Tuesday, November 3, 2 
To: msisac.org> 


Subject: RE: Michigan Voter Misinformation//Facebook 


Yes, please. 


ims Bureau of Elections 


| 


From: MS-ISACSOC 2 msisac.org> 

Sent: Tuesday, November 3, 2020 6:32 PM 

To: I © 0 cri gan.gov>; Ms-IsAC so! msisac.org> 
Subject: RE: Michigan Voter Misinformation//Facebook 


Do we have your permissionito share this with our federal partners by forwarding to our misinformation mailbox? Please 
see below. 


Reports of Elections Infrastructure Misinformation (“Misinformation”) submitted to the El-ISAC 

via misinformation@etsecurity.org will be shared with the following organizations: (1) the applicable 
social mediaplatform provider in order to address the Misinformation identified in the report; (2) the 
Cybersecurity &Jnfrastructure Security Agency and the Election Integrity Partnership, for analysis of the 
Misinformation, in conjunction with other relevant information, to identify potential threats to election 
security; (3) with the National Association for Secretaries of State and National Association of State 
Elections Directors for situational awareness. The Misinformation may also be shared with other federal 
agencies, as appropriate, for situational awareness or in the context of a law enforcement investigation. 


5 Tig, eat the maturity of your 
Re cybersecurity program. 
Register for the NCSR today! 
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Multi-State Information Sharing and Analysis Center (MS-ISAC) 
Election Infrastructure Information Sharing and Analysis Center (El-ISAC) 


24x7 Security Operations Center 


cisecurity.or 

@ ms-isac’ ~<A. Elections 
Multi-State information 4 Infrastructure 
Sharing & Analysis Center* ISAC 


0000 


Sent: Tuesday, November 3, 2020 6:27 PM 
To: MS-ISAC SOC) msisac.org> 
Subject: Michigan Voter Misinformation//Facebook 


https://www.facebook.com/profile. php?id=1576601744 


Hello, 

The link belowis a Michigan voter whois spreading misinformation being Facebook saying he voted for 300 people. We 
have had local law enforcement contact himand he has pulled the post. Hours late (about an hour ago) he started 
posting it again. Is this something you all can assist with getting Facebook to pulldown? We have received a numberof 
complaints about this post perhour. 


https://www.facebook.comfprofile.php?id=1576601744 


Thank you! 


Michigan Bureau of Elections 


Michigan.gov 


This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 


MOLA_DEFSPROD_00008699 


CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 66 of 111 PagelD #: 
2814 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments. 


cP 


¢ 


\O 
Cy 
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Misinformation Reports [misinformation@cisecurity.org] 


1/3/2020 3:53:03 PM 
cise chs cov] EI ciso.chs cov! EEF ha.chs-gov!; 


2020partnership.atlassian.net; Misinformation Reports [misinformation@cisecurity.org] 


fb.com EEF fb.com] 


-MIS000133: Misinformation Facebook postregarding number of votes/voters in CO. 


i = = we have included Facebook in this report. 


Misinformation report: Facebook post regarding number of votes/voters in Colorado 


From: © sos. stAte.co.us> 

Sent: Tuesday, November 3, 2020 3:44 PM 

To: Misinformation Reports <misinformation@cisecurity.org> 
Ce: sos.state.co.us>; 
SOS.STATE.CO.US>;| 
'sos.state.co,us>; I@SOS,.STATE.CO.US> 
Subject; Potential Foreign Mis/Dis Information on the Election Process =Facebook Post 


Partners, 


As part of the Colorado Department of State’s (CDOS) efforts to counter foreign mis/dis information on the election 
process, we have been made aware of the followinginaccurate information. We know this information is false because 
we’ve had 2,893,395 vote out of a possible 3,783,589 registered voters. Thisis nota call to action, but merely providing 
for youinformation. 


https://www.facebook.com/dpatric/posts/10223827649629519 
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~— 


~ 


{@ 


Facebook shows 6.2 million 
people voted in Colorado, 
population is 5.4 million. No 
voter fraud here haha 


7) ( 


Disclaimer: Colorado Department of State is not the originator of the above information andis forwardingit, unedited, 
fromits original source. The Department does notseek the ability to remove or edit what information is made available 
on social mediaplatforms. The Department makes nojrecommendations about how the information itis sharing should 
be handled or used by recipients of this emai|. The Department may also share this information with local, state, and 
federal government agencies. 


Thanks, 


Colorado Departmentof State 
Secretaryof State 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments. 
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Misinformation Reports [misinformation @cisecurity.org] 
11/2/2020 4:45:48 PM 


'fb.com]; Misinformation Reports [misinformation @cisecurity ore] 


cisa.dhs.gov]; 
2020partnership.atlassian.net 


Thank you. a. 


Fromm i ©f.com> 
Sent: Monday, November 2, 2020 4:45 PM 


To: Misinformation Reports <misinformation@cisecu rity.cr¢> iS isa.dhs cov> iy 
HERE ‘sa. dhs. gov>; @hq.dhs gov fo2020partnership.atlassian.net 


Subject: Re: Case J votes allegedly being changedin election machines. 


This has beenclosed out and the SoS has been informed. Thanks! 


From: Misinformation Reports <misinformation@cisecurityorg> 
Date: Monday, November 2, 2020 at 12:07 PM 


@cisa.dhs. gov>, aay 
Opartnership.atlassian.net" 
ion@cisecurity.org> 


Subject: Case #CIS-MIS000105: yotesvallegedly being changed in election machines. 


Misinformation report: votes allegedly being changed in election machines. 


|e attached and belawis a misinformation post on Facebook on the Bullitt County Clerk’s Office (KY). Could you 
please review? 


https://www.facebook.com/bullittcountyclerksoffice/photos/a.237424216303826/3537339692978912/ 


iz, we areiforwarding this report directly to Facebook but still want you to be aware of the issue. 


Election Infrastructure Information Sharing and Analysis Center 
Center for Internet Security 


Email: misinformation @cisecurity.org 


www.cisecurity.or 
Follow us} 
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Sent: Monday, November 2, 2020 12:37 PM 


To: Misinformation Reports <misinformation@cisecurity.org> 
Subject: FW: Screenshot 2020-11-02 at 11.41.30 AM 


Turning this in for review. . 


State Board of Elections 


: www.elect.ky.gov 


FE ravnaconinasovern SD. nt Wy Pong Pace 


“=. 


Election Calendar 


Kiysggov> 
: Screenshot 2020-11-02 at 11.41.30 AM 


Hs asked me to forward this screenshot to you of a comment on our Facebook post this morning. 


Thanks 


Bullitt County Clerk Office 
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11:417 ol LTE 


< Bullitt County Clerk's Office's Post 
VCriler (UF VITICIal CIlecudcell 
resources and local updates. 


Get Voting Information 


o Like © Comment’ = / Share 


@ Get more Likes, Comments and Shares 


This post is performing better than 85% of other 
posts on your Page. Boost it to show it to more 


people. 
656 people reached > Boost Post 
ond 
Os 
12 Shares 


Most Relevant 


i PROJECTS HAMMER & SCORE 
CARD - CHANGE VOTES IN 
THE ACTUAL ELECTION 
MACHINES - PLEASE 
INVESTIGATE & SHARE DATA 
TARGET STEAL 3% 


9m Like Reply 


Write a comment... © 
ft @ nn 2 = 
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Sent from my iPhone 


This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited, 
Please notify the senderimmediately and permanently delete the message and any attachments. 


This message and attachments may contain confidential information. If it appears that this message wa’ sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments. 
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fb.com] 


10/28/2020 11:46:36 AM 
cisecurity.org] 


Works for me - talk then! 


Sent from my iPhone 


On Oct 28, 2020, at 11:18 AM, ® <isecurity.org>wrote: 


Sorry | missed this. Can we talk at 12 ET? We can call youon thei numbers 


Sent: Wednesday, October 28, 2020 10:41 AM 
H isecurity.org> 
cisecurity.org>; 


Subject: Re: Facebook/CIS Meeting 


Thanks for following up! Tried togivel a call yesterday but know things are crazy. Feel free to call me at 
(I’m around for the next 20 min if you happen to be free now!) 


Sent from my iPhone 


On Oct 28, 2020, at’9:54 AM cise ceity.o12> wrote: 


Hi Justchecking back on this. 


Thanks! 


From: cisecurity.org> 
Date: Monday, October 26, 2020 at 6:13 PM 


To: fb.com>, cisecurity.or Imm 


HE @fb.com> 


Cc} cisa.dhs.gov>, fb.com>, La] 
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fb.com> 
Subject: Re: Facebook/CIS Meeting 
Sorry, | could have been much clearer! 


Let us propose an approach that balances minimal touchpoints with the election official while getting to the official 
directly whenit’s necessary: 


1) CIS gets a misinformation report 

2) When that report involves fb, CIS forwards it to the regional, copying CISA 

3) If fb needs more info, fb makes that request of CIS 

4) If CIS has that info, we provide it back to fb. If not, or you needa statement directly from them, we loop#fbin 


with the official. 


The goal forus is to make sure we’ re getting you everything we need from the authoritative source in Ourinitial report. 
So, again, if there have been deficiencies in our reporting, let us know the details of those issues. |think the flow above 
will also help us get to that goal. 


Overthe next 8+ days we arein nearconstant contact with many of these officials and we have touchpoints with them 
outside email, soeven when we don’t have the infoit will often be faster for us to getitforyou. 


| completely understand that from your perspective this is adding an unnecessarystep, butit became clear from our 
members today that there is a very real need forClS to help manage contacts with the many platforms. 


Thanks yet again, 


cisecurity.o1 > Zi” 
cisa.dhs.gov>, fb.com>, 


Subject: Re: Facebook/CIS Meeting 


Thanks — just to make sure | understand, does this mean that you are not comfortable looping us directly in with 
the reporting authority? 


<Image001 .gif> 


aifb.com 
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cisecurity.org> 
(, October 26, 2020 at 3:58 PM 


Subject: Re: Facebook/CIS Meeting 


Thanks 


We appreciate the call today. We think a direct line from CIS to Fb’s regionals will be much more efficient foreveryone 
and CISAis agreeable tothat approach. 


After talking with some of our members, we don’t believe itis reasonableto | eave CIS out of the loop for any part of the 
misinformation efforts. They were adamant that the one of the critical roles for CIS in this process isito broker the 
interactions and take work off of theirvery, very full plates. They expressed that excluding CIS fram the process would 
make their jobs more difficult, take up more of theirtime, and weaken our efforts to ensure afair election. They also felt 
that if there is information they did not feel comfortable sharing with CIS (or any athetparty) over e mail, itis their 
responsibility to remove that party from the email. 


Our focus is on making life easier forthem, not for ourselves or anyone else. We need to make that the priority. We urge 
you work directly through us and allow us to brokerany additionahinformationgathering from our members. 


This will help us serve them bestand will avoid the scenario where representatives from facebook, twitter, nextdoor, 
snap, tiktok, and others are all reaching out to them, potentially abouta single report that they submitted to us, likely 
requesting the same or similarinformation. 


To hasten action on misinformation, we believe it’s best if Fb,provides CIS with specific feedback on what you’ ve found 
lacking in submissions so we can ensure that we have that information before we senditon to you. That will help your 
efforts as well as cross-platform efforts. 


I'd be remiss to not mention that our members felt strongly about the importance of accountability in this process. With 
the extraordinary pace our members are carrying right now, ClSisin a better position to track which platforms have 
responded and how. It’s in the nation’sinterest that we have an understanding of how various platforms are managing 
and responding to reports of misinformation submitted by authoritative sources. This is another role that CIS plays and 
one that our members have expressed is of utmost importance for this election and beyond. 


| hope thisis all agreeableto you. We’ re happy to have a follow up call if you’d like. 


Thanks again, 


Date: Monday, October 26, 2020 at 12:57 PM 
To; 


Cc: 
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Thanks for taking the time to meet with us this morning! I’m attaching my team’s regional divideto this email, and look 
forward to connecting later today after you've hada chance to connect with some of your stakeholders. 


Best, 


<image002. 


From: icisecurity.org> 


Date: Friday, October 23, 2020 at 6:09 PM 


Subjec Facebook/CIS Meeting 


That’s great. | justaccepted. 


fb.com> 
riday, October 23, 2020 5:27 PM 


cisecurity.org>; fb.com> 


Subject: RE: Facebook/ClS'Meeting 


Hi Aaron— 
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How about 11a ET on Monday, October 26? 
I’ve sent overa calendar hold with the below dial-in details for the call. 


Best, 


WAYS TO JOIN 


Computer or Mobile 


Facebook Meeting Room and Portal: 
Use the touch panel in yourroom or Portal to enterthe joincode 


Telephone: 
i rr 
or 

Dial an alternative number from 


From {iE cisocurity.org> 
Sent: Friday, October 23, 2020 1:18 PM 

fb.com> 
fb.com>; 
cis@curity.org>; fb.com> 
Subject: RE: Facebook/CIS Meeting 


Sounds good. We are flexible on Monday outside of 12:30+2p ET. Letus know what times work for you, 


Thanks, 


Sent: Friday, October 23, 2020,1:13, PM 


iH security.org> 
icisa.dhs.gov: fb.com>; iy 
; © cise curity. org>; I ©fb.com> 


Subject: Re: Facebook/ClS Meeting 


Sorry —just getting to this. 


My schedule has blown upa bit today so may need to punt until Monday. 


| i help schedule and provide dial in. 
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Many thanks, all! 


Sent from my iPhone 


Addineliiiifon my side. We are free between 1-3pm ET today. Howis 1pm ET foreveryone? 


Thanks, 


Ce: ifb.com>; 
Subject: Re: Facebook/ClS Meeting 


Many thanks 


Hi who leads ouroutreach to State Election Officials andito help schedule. 


Let us know if you have some time later today or an afternoon early next week to discuss some refinements to the 
reporting structure. 


Many thanks, 
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Sent from my iPhone 


On Oct 23, 2020, at 9:51 AM I © «isa. ahs gov> wrote: 


I've spoken with [at cis about getting together fora call to discuss reporting and he’s open to having the 
conversation. | have cc’d him here to facilitate you all finding atime that works. Feel free to invite me (or not) if|can 
be helpful. 


Regards, 


[Countering Foreign Influence Task Force 
DHS/CISA/NRMC 
lh 


This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attach ments. 


This message and attachments may contain confidential information, If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly pro hibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 


This message and attachments may contain confidential information. If it appears that this message was sent to you by 


mistake, any retention, dissemination, distribution or copying of this message and attachmentsis strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 
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This message and attachments may contain confidential information. If itappears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 


This message and attachments may contain confidential information. Ifit appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message ahd attachments is strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments. 
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@ twitter.com] 
AM. 
cisa.dhs.gov] 
@twi com] 


: Case #CIS-MISO00033: Misinformation tweet to vote in-person in Washington state 


Hii this Tweet has been actioned for violating our mules. 


On Wed, Oct 7, 2020 at 807 PM © cisadhs.cov> wrote: 


We received the below report from Washington. 


Regards, 


The Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security 
(DHS) is not the originator of this information. CISA is forwarding this information, unedited, from its 
originating source — this information has not been Originated or generated by CISA. This information may also 


be shared with law enforcement or intelligence agencies: 


CISA affirms. that it neither has nor seeksthe ability to remove or edit what information is made available on 
social media platforms. CISAemakes noecommendations about how the information it is sharing should be 
handled or used by social. media Gompanies. Additionally, CISA will not take any action, favorable or 


unfavorable, toward social media companies based on decisions about how or whether to use this information. 


From: Misinformation Reports <misinformation@cisecurity.org> 
Sent: Wednesday, October 7, 2020 8:04 PM 


To: Misinformation Reports <misinformation@cisecurity.org>; @cisa.dhs.gov>; 
BP ha.dhs.gov>; @cisa.dhs.gov>; @2020partnership.atlassian. net 


Subject: Case #CIS-MIS000033: Misinformation tweet to vote in-person in Washington state 
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Misinformation tweet to vote in-person in Washington state 


Begin forwarded message: 


Dat tober 7, 2020 at 7:48:49 PM EDT 


To: Misinformation Reports <misinformation@cisecurity.org> 


Ce: (SOS. wa. gov>, iDsSOs.wa. gOv> 


Subject: Possible misinformation on Twitter 


Hello, 


I wanted to flag this tweet the Washington Office of the Secretary of State’s official Twitter account was 
tagged in. I’ve attached a screenshot of the post itself, and it can be found here 
https//twitter.com/JeffK is88392967/status/13 13926786804 113408 


The reason I am flagging this as potential misinformation isvit’s not\clearif this tweet is a simple statement or 
recommendation to “conservatives,” or if this is a directive. If if'swthe latter, that would not be true. In 
Washington state, voters may return their ballots by mail, by placing their ballot in an official ballot drop box, 
or by visiting a county voting center. 


My name yO and ’m he for the Washington Office of the Secretary of 


State. [can be reached via this email or the two numbers listed in my signature block below. My cell = i 


monitored after hours if I need to be reached urgently. Iam also copying Washington State 


Please let me know if youyhave any.questions or need additional information. 


Thank you. 


(g)Secretary of State 


Tit Kiyo — 
BOB 
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@secstatewa All conservatives vote in person. Don't 
trust the mail 


~ —~ \ Gy 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is 
strictly prohibited. Please notify the sender immediately and permanently delete)the message and any 
attachments. 
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cisecurity.org] 
10/7/2020 3:33:22 PM 
twitter.com 


cisa chs gov) IT © cisa.chs gov]; 


twitter.com 
RE: El-ISAC & Other 


|CAU f c ‘clicklinks or open attachments unless you recognize and/or trust the 
ender. Contact your component SOC with questions or concerns. fm = 


It has not, goes out end of day. We will pull the link. 


I-ISAC 
cisecurity.or 


24x7 Security Operations Center 


Miocisecurity.org - 


@& ms-1sac A. Elections 
Mutp-st * Infrastructure 


==, eae the maturity of your, 
cybersecurity program.) 
Register for the NCSR today! 


Wednesday, October 7, 2020 12:37 PM 


cisecurity.org> 


cisa.d hs. ov> © ci sa.dhs.gov>; 


Subject: Re: El-ISAC & Other 


Hi has the El-ISAC notice gone out yet? We are not reaching critical mass so we are likely to postpone. (It 
is almost like these guys are administering an election out there!) If the note hasn't gone out, please pull the info 
about tomorrow's training. But feel free to leave in the information about PSP -- that work is ongoing. If it has 
gone out, we will just notify any folks who register ourselves 


Thanks so much! 


1 


MOLA_DEFSPROD_00009613 


CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 85 of 111 PagelD #: 
2833 


Yes, we keep events in our distribution until they happen so it will go out with our next product tomorrow 
afternoon. 


= 
| ia 
cisecurity.or 


24x7 Security Operations Center 


Bb isccurty. oo 


@ ms-isac* Elections 
Muto ** Infrastructure 
Sharing 8 - tSAE 


______ Measure the maturity of your| 


cybersecurity program. 
Register for the NCSR today! 


Sent: Monday, October 5, 3:55 PM 


To: cisecurity.org>| cisa.dhs, ov 


cisa.dhs.gov> 
twitter.com 
Subject: Re: El-ISAC & Other 


Hi wm is it possible to send out the invitation to the training for state and locals again? Our RSVPs are 
essentially non-existenty 


State and Local Election Officials: Please join Twitter on Thursday, October 8 from 3:30 - 430 pm EST fora 
training’ on creative and effective content strategies on Twitter in advance of the U.S. Election. You will hear 
the latest\on product updates, best practices, and strategy for creating engaging content! Time for Q&A will be 
reserved at the end. RSVP here: https//trainingforuselectionpartners.splashthat.com/ 


On Thu, Oct 1, 2020 at 11:06 AM © tvitter.com> wrote: 


Thank you so much for sending it out. The BB twitter com still absolutely works! 


On Thu, Oct 1, 2020 at 10:52 <M ED cisccurity oro> wrote: 
| 
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Hopefully you've gotten some signups. | just learned a one pager another part of CIS shared with the 
community included the oder liter com email. We'll be updating going forward to the PSP address 
but do we need to go back to folks that have that to correct or will that still work? 


24x7 Security Operations Center 


ae 
@& ms-sac* <A. Elections 


Mun ** Infrastructure 
ISAC 


0000 


Malicious Domain Blocking and Reporting (MDB) Gy 
; urroa 
PreventIT systems from connecting Mom 


to harmful web domains at no cost 


From: twitter.com> 
Sent: Tuesday, September 29, 2020 4:23 PM. 
To: cisecurity. 

Ce; twitter.com 

Subject: Re: El-ISAC & Other 


- apologies for the typo -- RSVP is in the first paragraph twice. Thank you in advance for fixing my 
hasty mistake :) 


On Tue, Sep 292020.at 4:17 PM HR 2 «\i::¢r- com> wrote: 


Hi are you able to add these two updates to your weekly news alert that is distributed to state and local 
election officials? Thank you! 


(1) State and Local Election Officials: Please join Twitter on Thursday, October 8 from 330 - 430 pm EST 
for a training on creative and effective content strategies on Twitter in advance of the U.S. Election. You 
will hear the latest on product updates, best practices, and strategy for creating engaging content! Time for 
Q&A will be reserved at the end. RSVP here: RSVP link 

here: https:/trainingforuselectionpartners. sp lashthat.com/ 
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(2) We are onboarding state and local election officials onto Twitter's Partner Support Portal. The Partner 
Support Portal is a dedicated way for critical stakeholders -- like you -- to flag concerns directly to Twitter. 
These concerns can include technical issues with your account and content on the platform that may violate 
our policies. Email PSPOnboarding@Twitter.com to enroll. 


And please note the URL name -- it sometimes prompts an erroneous autocorrect. Please let me know if you 
have any questions! 


Thank you, 


On Thu, Sep 17, 2020 at 122 PM RD <isecurity ore> wrote! 


Please forgive for the delayed response. Typically, with private Sector partners we would feature 
new initiatives in our weekly news alert (Wednesday afternoons), with aone paragraph summary. 
We typically link to some sort of public reporting, whether you have a release on PSP or a page 
where you've been directing sign-ups that we can/point folks to. With regards to the training, we 
have an “upcoming events” section in the same product that'we can include links for 
signup/webinar location or an email to contact. 


Let me know, 


Best, 


24x7 Security, Operations Center 


Beco: 


®& msusac’ A. Elections 
i ** Infrastructure 
ISAC 


Malicious Domain Blocking and Reporting (MDBR) qe 


5 We FOR 
Prevent IT systems from connecting ‘som 


to harmful web domains at no cost 
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Sent: Wednesday, September 2, 2020 3:33 PM 


Atwitter.com>; @cisa.dhs. gov> 
@twitter.com>; @cisa.dhs.cov>; 
@cisa.dhs.gov>; )cisecurity.org> 


Subject: RE: EI-ISAC & Other 


Thave cc’ 


the EJ-ISAC on this email 


Also, if you have items that we can share through our channels we are happy to take a look 


Department of Homeland Security 
Cybersecurity & Infrastructure Security Agenéy (CISA) 


@hq.dhs. gov 


OL er 
Sent: Wednesday, September 2, 2020 3:06 PM 


)twitter.com> 
Subject: EI-ISAC & Other 


Long lost friends, how are you? Hope you got in a few quick breaks this August 


Do you have contact information for the team at the EI-ISAC? We want to send a message to state and 
local election officials inviting them: (1) to be onboarded to the Partner Support Portal (previously this was 
reserved only for state-level; we are now expanding for locals) and (2) a training for best-practices on 
creating credible and engaging content 
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Any other issues we should be connecting on? 


Thanks, 


This message and attachments may contain confidential information. If it appears that this message was 
sent to you by mistake, any retention, dissemination, distribution or copying of this message and 
attachments is strictly prohibited. Please notify the sender immediately and permanently delete’ the 
message and any attachments. 


This message and attachments may contain confidential information. If it appears thatethis message was sent 
to you by mistake, any retention, dissemination, distribution or copying ofthis message and attachments is 
strictly prohibited. Please notify the sender immediately and permanently deleteéthe message and any 
attachments. 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is 
strictly prohibited. Please notify the sender immediately and permanently delete the message and any 
attachments. 


This message and attachments may Contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments 
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com I cur oe 
Sent: 6/17/2020 12:58:15 PM 
To: 


cc: iter. ; Icisa a, 
isa.dhs 4 i cisa.dhs.gov]; 
isa.dhs.gov], cisecurity.cr¢) ; in cis ecurity.org]; 
cisecurity.org) 


vO | a 


m); twitter.com]; |@ twitter.com) 
Subject: : i CIS, NASS, NASED and Twitter 


Sorry | am just getting this to you a few minutes before our meeting. We are lookingforward to talking through these . 


1 Will there be some sort of agreement or terms of reference that will align allparticipants (reporters, 
government entities, companies) on objectives and usage of the portal? 

Yes, we'll establish Terms of Reference (or equivalent agreements) for the portal” Broadly speaking the 
objectives are: 


. CIS: vet election officials to ensure that all information réported,to the platforms comes from the 
authoritative source for that information. 

. Election offices: submit report of misinformationthat, as the official authority a certain information, can 
be stated as factually inaccurate 

. Social media companies: process reports and provide timely responses, to include the removal of 
reported misinformation from the platform where\possible. 

. National associations: maintain awareness of occurrences of misinformation and communicate with 
other partners as necessary 

. Other partners: not on the critical path ofthe initial rollout; can be discussed as the platform evolves 

2. Whowill have access to view/analyze reported information? Will there be any restrictions in place to 


dictate what can be done with this information? 
This will be covered in the agreements, which will limit use of data. Broadly speaking usage will be 


. CIS: access to all informationvand ability to analyze and communicate about that information with 
election offices and social media companies 

. Election offices: submit report of misinformation that, as the official authority a certain information, can 
be stated as factually inaccurate’ 

. National associations: access to all information and ability to analyze and communicate about that 
information with election offices and social media companies 

. Sociahmediacompanies: Access to reports necessary to investigate and come to a decision 

. Other partners? not on the critical path of the initial rollout; can be discussed as the platform evolves 

3; Would other companies have access to see reports for other platforms? | believe our answer is no we 


will not share the reports. However, based on the set of reports, we may share indications of campaigns of 
misinformationacross platforms. What if the report has content from multiple companies? We have it setup 
where the samples are separated by platform. The top-level report information would be shared with any 
platform where a sample was provided. We are open to handling this differently and look forward to your 
thoughts here. 

4. Whatis the criteria used to determine who has access to the portal? The criteria has already been 
determined (elections officials vetted by CIS, NASS, NASED, DHS and social media platforms). Any others will 
be on a case-by-case basis with a specific formal terms of access agreement. How many individuals do you 
anticipate having access? There are roughly 9,000 elections offices. We expect as much as half may 
participate in the portal over time. 


MOLA_DEFSPROD_00010210 


CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 91 of 111 PagelD #: 
2839 


By How long will reported information be fenined’ 


6. How long will the portal be in operation? Just through the 2020 presidential election? The portal will be 
evaluated in January 2021 regarding demonstrated benefits, potential enhancements, and opinions by the 
elections community regarding continued operation. 

vs Companies’ terms of service vary. How will individuals know what to report? Wewill cover this in the 
Terms of Reference and in the instructions given to users as they use the platform. The elections officials will 
report suspected misinformation related to elections. The platforms will have to assess the misinformation, 
including applicability of specific terms of service for the platform 

8. Will there be any quality checks in place? Will there be a review of reports before they are submitted to 
companies? Will all reports be treated with equal priority? The reporting mechanism has requirements on 
which fields are required. This validation can be altered based on the "type" of report. We areopen to adding 
more validation based on your feedback. We do not anticipate any manual review of the contentiitself: The 
reporter can set a priority, but we should discuss the implications of that to all involved. 

9. Will partners continue to use Partner Support Portal (PSP) or will everyone migrate to this reporting 
tool? We'd like to encourage election officials to use the Reporting Portal, but we believe it makes sense to 
continue to operate the PSP in parallel through this election and evaluate it afterward. 


Thanks, 


cisecurity.or 


C I S. Center for Internet Security” 


0000 


From: © twitter.com> 
Sent: Tuesday, June 16, 2020. 3:59 PM 
cisecurity.org> 


cisecurity.org>; 


twitter. com>; © witter.com> 


Subject: Re: Reporting Portal with CIS, NASS, NASEDand Twitter 


All, 


Below are some of the questions we hope to discuss during our next call. Looking forward to it! 
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1. Will there be some sort of agreement or terms of reference that will align all participants 
(reporters, government entities, companies) on objectives and usage of the portal? 
2 Who will have access to view/analyze reported information? Will there be any restrictions in 
place to dictate what can be done with this information? 
3. Would other companies have access to see reports for other platforms? What if the report has 
content from multiple companies? 
4 What is the criteria used to determine who has access to the portal? How many individuals do 
you anticipate having access? 
5: How long will reported information be retained? 
6. How long will the portal be in operation? Just through the 2020 presidential election? 
7 Companies’ terms of service vary. How will individuals know what to report? 


8 Will there be any quality checks in place? Will there be a review of reports before they are 
submitted to companies? Will all reports be treated with equal priority? 

9. Will partners continue to use Partner Support Portal (PSP) or will everyone; migrate to this 
reporting tool? 


On Fri, Jun 12, 2020 at 3:40 PV cisecu rity.ore> wrote: 


Wednesday from 1-2 ET works for our team. | will send an invite. 
| will also follow up separately with you on setting up accounts. Have a great weekend. 


Thanks, 


cisecurity.or 


C I S. Center for Internet Security" 


e0o00 


Sent: Friday, June 12, 2020 2:29 PM 
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iO cisecurity.org> 


@twitter.com>} @cisa.dhs.gov>;| 


(@twitter.com> 


— 


Thanks again for this group's time yesterday. Can we schedule our next follow-up for next Wednesday from 1-2pm? 
We'll share some of our questions ahead of that call to helpinform ourdiscussion. 


Also, would you be able to help us establish some log-ins for us to test out the tool? 


Thanks! 


On Wed, Jun3, 2020 at 4:52 rv © cisecurity.org> wrote: 


That works for us here at cis iii sendan invite shortly. 


Thanks, 


C I S. Center for internet Security* 


0000 
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From SRI oe com> 
Sent: Wednesday, June 3, 2020 4:08 PM 


7 | 
Thank you for your patience. Would 3:30 next Thursday (6/11) work for a follow-up call? 


Best, 


| hope you are doing well. | knowitis a busy week with the election tomorrow. When you can, please let us knowa 
good time to reschedule our meeting from last week. We will have some updates to share about our beta testing 
with election officials and a possible nationwide training collaboration with the Belfer Center. 


Thanks, 


| ~~, 


C I S. Center for Internet Security” 


0000 


twitter.com> 
day, May 22, 2020 4:30 PM 
cisecurity.org> 


MOLA_DEFSPROD_00010214 


CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 95 of 111 PagelD #: 
2843 


twitter.com>; 


Subject: Re: Reporting Portal with CIS, NASS, NASED and Twitter 


| 


Thank you for your email and for yourtime last week. We support your goals in establishing this tool, but still needto 
run some traps internally regarding options to receive the info and provide feedback. Happy toischedule a follow-up 


call next week, though we may still have more questions than feedback at that point. If that works for you all, let's 
aim for 4:30 pm EST. 


Best, 


On Thu, May 21, 2020 at 3:25 2 cisecurity.org>wrote: 


Thank you so much for the call last Monday.! hope it proved helpfulas you went back to your team at Twitter. With 
the elections nearing, we are eager to hear ifyou have anything you can share from your internal conversations. Are 
you available fora 30 min follow up call next week? We have afew time slots next Thursday if any of these work for 


you: 9-10am, 2-2:30pm, and 4-5pm (Eastérn). Ifthese don’t work for you, we can shuffle some schedules around. 
Just let us know what works bestfor you. 


Thanks, 


= 
cisecunity.o1 


lap 


C I S. Center for Internet Security” 


0000 
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Original Appointment: 
For isons gov> 
Sent: Wednesday, May 6, 2020 9:31 AM 


Subject: Reporting Portal with CIS, NASS, NASED and Twitter 
When: Monday, May 11, 2020 2:00 PM-3:00 PM (UTC-05:00) Eastern Time (US & Canada). 
Where: WebEx invite just sent separately — please use thatinformation 


Senta separate invite to use WebEx forthe meeting. Please let me know if you don’treceiveth@ WebEx invite. 
Thanks, 


This message and attachments may contain confidential information. If itappears that this message was sent to you 
by mistake, any retention, dissemination, distribution or copying of thismessage andattachments is strictly 
prohibited. Please notifythe senderimmediately and permanently. delete the message and any attachments. 


This message and attachments may contain confidential information. If it appears that this message was sent to you 
by mistake, any retention, dissemination, distribution ofcopying of this message and attachments is strictly 
prohibited. Please notifythe sender immediately andpermanently delete the message and any attachments, 


This message and attachments may contain confidential information. If itappears that this message was sent to you 
by mistake, any retention, dissemination, distribution or copying of this message and attachmentsis strictly 
prohibited. Please notify the senderimmediately and permanently delete the message and any attachments. 


This message and attachments may contain confidential information. If it appears that this message was sentto you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the senderimmediately and permanently delete the message and any attachments. 


This message and attachments may contain confidential information. If it appears that this message was sent to 
you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly 
prohibited. Please notify the sender immediately and permanently delete the message and any attachments 


MOLA_DEFSPROD_00010216 


CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 97 of 111 PagelD #: 
2845 


cD 


¢ 


\O 
Cy 


MOLA_DEFSPROD_00010217 


CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 98 of 111 PagelD #: 
2846 


o.com] 
3/13/2020 11:13:52 AM 


cisa.dhs.gov] 


fb.com] 
Re: Tweet reguarding voting & COVID-19 - DISINFORMATION 


CAUTION: This email originated from outside of D DHS. DO NOT clicklinks or open attachments unless you recognize and/or trust the 
sender. Contact your component SOC with questions. or concerns. 


Thanks, 


Sent from my iPhone 


On Mar 13, 2020, at 10:55 AM, i cisa.dhs.gov> wrote: 


Apparently the tweet | sent has been taken down. Pleasesee the screenshot below withthe tweet. 


Thanks, 


Sent: Friday, March 13, 2020 10:51 AM 

To: cisa.dhs.gov> 

Ce: cisa.dhs.gov>/ iin © cisa.dhs.gov> 
Subject: FW: Tweet reguarding voting & COVID-19= DISINFORMATION 


From OH inscreen shot form and reported ta\ClOcc. 


Department of Homeland Security 
Cybersecurity & Infrastructure Security Agency (CISA) 


ME 0111005.cov> 


jay, March 13, 2020 10:39 AM 


HE © Ohi0SOS.Gov>; msisac.org>; © msisac.org> 
4 isa.dhs.go' OhioSOS.Gov> inn 


hioSOS. Gov>; © Ohi oSOS.Gov>; 


OhioSOS.Gov> 


Subject: Tweet reguarding voting & COVID-19- DISINFORMATION 
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The following disinformation regarding upcoming Ohio, Florida, I!linois, Louisana, and Wisconson elections and 
COVID-19 was posted to twitter: 


https://twitter.com/coocbie/status/1238465759745134593?s=21 


<image. png> 


; Office of the Ohio Secretary of State 
<~WRD318,jpg> 


OhioSoS.gov 
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2 ss 
<4 Messages all © 10:31 AM 4 62% (2 


< Thread 


DEAR ALL BOOMERS, 


Due to COVID-19, it should be in your 
highest interest to refrain from 
entering polling stations in Illinois, 
Florida, Ohio, Louisianasand 
Wisconsin!!! 


This is for yourown safety. 
| repeat, BOOMERS DO NOT VOTE 
10:03"AM - 3/13/20 - Twitter Web App 


G&Likes 


Tweet your reply 


a Q £2 im 
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From: 


Sent: 10/26/2020 9:02:43 AM 


To: twitter.com] 
cc: twitter.com] HE? © *er-com); 2 hg.dhs.gov]; 


Misinformation Reports [misinformation@cisecurity.org] 


Subject: RE: FW: Case #CIS-MISO00067; Youtube video alleging conspiracy by election administration in Detroit, MI 


Thanks 
| 


From I t2r-com> 


Sent: Monday, October 26, 2020 12:40 AM 
sa.dhs.gov> 


To: 
Ce: | _}—?<——— a — ooeee 


Misinformation Reports <misinformation @cisecurity.org> 
Subject: Re: FW: IS Youtube videoalleging conspiracy by election administration in Detroit, MI 


$ you recognize and/or trust th 


Thanks, We have taken enforcement action for violations of our policy on civicintegrity. 
Thanks! 


On Sun, Oct 25, 2020 at 10:44 PM twitter.com>wrote: 
Thanks, EE. We will escalate. 


On Sun, Oct 25, 2020 at 10:43 PM cisa.dhs.gov>wrote: 
Good evening Team Twitter, 


Please see the belowandattachedireporting from Detroit. 


Regards, 


The Cybérsecuritwand Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security (DHS) is 
not the originator of this information. CISA is forwarding this information. unedited. from its originating source — this 
information has not been originated or generated by CISA. This information may also be shared with law enforcement 


or intelligence agencies. 


CISA affirms that it neither has nor seeks the ability to remove or edit what information is made available on social 


media platforms. CISA makes no recommendations about how the information it is sharing should be handled or used 
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by social media companies. Additionally, CISA will not take any action. favorable or unfavorable, toward social media 


companies based on decisions about how or whether to use this information. 


From: Misinformation Reports <misinformation@cisecurity.org> 
Sent: Sunday, October 25, 2020 10:35 PM 


To: cisa.dhs, o>; EE © cisa.dhs.gov>; MO hg.dhs.gov>; 


/2020partnership.atlassian.net; Misinformation Reports <misinformation@cisecurity.org> 
Subject: Case SUC Youtube video alleging conspiracy by election administration in Detroit,MI 


Misinformation report: YouTube video, also shared on Twitter, alleging conspiracy by electiomadministration in 
Detroit, MI 


From: © ferndalemigov> 
Sent: Sunday, October 25, 2020 10:16 PM 
To: Misinformation Reports <misinformation@cisecurity.org> 


e and Twitter: "#DETROITLEAKS" video from 10/21/2020 


Subject: Disinformation attack on Yout 


Hello El-ISAC, 


My name rOUUtCO*S lam the I for the city of Ferndale, Michigan. My email addressis 
Beers: £OV, 


lam reportinga disinformation,misinformation) attack video that was posted on YouTube on October 21 and 
repeatedly posted on Twitter since then, targeting election administration by the City of Detroit and State of Michigan 
and alleging an organized conspiracy by City and State employees. 


ThewWideois titled: 
#DETROITLEAKS: State Employees Train Poll Workers to Lie to Voters,Destroy Ballots,Stop Challengers [sic] 


The title card (which shows on Youtube’s search screens and onsome links) is: 
“The Vote Fraud Scheme To Steal Michigan” 


| have attached a screenshot of this title card, as requested by El-ISAC. 


The video can be found here: 
https://www.youtube.com/watch?v=uHeodzI5cNM 


MOLA_DEFSPROD_00010539 


CONFIDENTIAL 
Case 3:22-cv-01213-TAD-KDM Document 71-8 Filed 08/31/22 Page 103 of 111 PagelD #: 
2851 


It was posted by this user: 
https://www.youtube.com/channel/UCWs1IIWCNra9Zf8Xew9mTsw 


It has been posted on Twitter multiple times since October 21, almost entirely by @bigleaguepol (“Big League 
Politics”), whichis a far-right site that appears to primarily invent conspiracy theories andis operated by former 
Breitbart News employees, The tweets about the video use the same #DETROITLEAKS hashtag as the videotitle. This 
account ‘teased’ the video ina tweet on October 20. 


The videotakes whatit alleges are recordings of “State Employees” (which are more likely City of Detroit Department 
of Elections employees, although they do notidentify themselves in the audio), and misrepresentsthe audio by using 
on-screen commentary to misinform the viewer of the video. 


. From 2:32 — 4:16, the person in the audio is describing the correct process fora provisional affidavit ballot (also 
colloquially called a “challenged ballot”). 


° At 2:42, the on-screen text claims that “Before 2020, NO challenged ballot would go into the tabulator.” 
Thisis nottrue. Provisional affidavit ballots, as well as challenged absentee ballots, havealways been fed through the 
tabulatoron Election Day. That is exactly why they are prepared ascorrectly describedin the audio (ballot number 
written on the ballot and covered up witha removable sticker) —which makes the claim at 3:04 completely wrong. 
Provisional Affidvait ballots always get voted as normal and are placed into the tabulator. Provisional Envelope ballots 
are sealed individually inside their own envelope (not placedintothe tabulator) and are returned tothe City Clerk for 
processing in the following days. These processes are nobnew to,2020; they have beenin place for overa decade. 


° At 3:55, the textincorrectly claims that “all challenged ballots WILL be counted immediately on Election 
Night”, whichis wrong. Provisional Affidavit ballots are counted along with all others. Provisional Envelope ballots are 
not. 


° 4:12 attempts to cast doubt on the process of identifying and removing a ballot deemed uncountable — 
which would only happen undercourt ordér,as only Provisional Envelope ballots would wind up inside the tabulator 
or the sealed ballot container andm@edtto be retrieved. The videoclaims “This will NEVER happen. Unless MAYBE ina 
recount.” Recounts have little todo with Provisional Affidavit ballots, and the assertion that the justice system would 
never take action to reverse proven voter fraud is entirely baseless. It serves only to cause the voter to doubt the good 
intentions of the judiciaryand the justice system. 


. At 4:20, the videorefersito the Clerk's Office Voter Registration Receiptas “an easily-forged piece of paper”. 
Again, thisis a baselessaccusation intended only to denigrate the legal election process and cause the video viewer to 
feel fearand doubt the security of Michigan's election. 


. At 7:30, the Videoinsinuates that simply using “children” (16- and 17-year olds, allowed under state law) as 
election inspectorsis an intentional part of a conspiracy to intentionally undermine the election. 


. At 9:04, the audio and the on-screen captions describean absentee ballot that has been “Sent and received”, 
meaning the Clerk has received the voted ballot from the voter and recorded itas such. This would have happened 
multiple days priorto the election. At 9:14, the videoimmediately turns around and ignores that by presentinga 
hypothetical ‘scenario’ where the voter might not have returned that very same ballot. This is completely 
contradictory, andis a total misrepresentation of the audio from the actual training sce nario that has been recorded. 
At 9:23, the trainerin the audio even specifically says “You've already voted.” 
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This videois misinformation and disinformation because it repeatedly takes normal processes being correctly 
described as written in state law, and alleges in on-screen text that they are somehow problematic, or will not be 
followed. On multiple occasions, the on-screen text directly contradicts the audio. However, these are items that 
would likely only stick out toan election administrator; amember of the general public would follow the video’s lead 
and assume that there is somehow a problem being described. Furthermore, the video makes outright falseclaims, 
alleging actions that are prohibited under Michigan election law. 


Copied on this email are the following individuals and offices, perthe directions from El-ISAC: 


. En iy Ferndale 

. Ee ity of Detroit Department of Elections 
. Bureau of Elections at the Michigan Department of State 

. Civics Outreach office at Google 


. Government office at Twitter 


This videois an attack on the City of Detroit, the State of Michigan, and by directextension, all local election 
administrators in the state of Michigan, suchas myself. This will disinform voters outside Detroit as easily as voters 
inside Detroit. Indeed, the choice of words throughout the video and in thecallsto action at the end of the videoinfer 
that the video’s audience is primarily people who are not Detroit residents. If that audie nce can be spurred to create 
unrestin Detroit, they can easily do the same in other jurisdictions, such as my jurisdiction as Detroit’s immediate 
northern neighbor. 


Thank you for your investigation and action. If can be of anyfurtherassistance, please let me know and | will be 
happy to provide support. 


Best, 


City of Ferndale 


This message and attachments may contain confidential information. If it appears that this message was sent to you 
by mistake, any retention, dissemination, distribution or copying of this message and attachmentsis strictly 
prohibited. Please notifythe senderimmediately and permanently delete the message and any attachments. 
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10/2/2020 7:28:36 PM 
To: ES © 6 <0] TS com) 
Subject: FW: Case #CIS-MISO00026: Facebook misinformation regarding absentee ballots mailed outin Scott County, IA. 
Attachments: IMG_4219.PNG; IMG_4220.PNG; IMG_4221.PNG; IMG 4222.PNG 


Good evening, 


Because who doesn’t like to start their weekend with some election related disinfo, I’m sharing a report from Scott 
County, IA. As usual, anything youcan share on howyou ail handied the reportis appreciated. 


The Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security (DHS) isnot the 
originator of this information. CISA is forwarding this information, unedited, from its originating source —this information 
has not been originated or generated by CISA. This information may also be shared with law enforcement or intelligence 


agencies. 


CISA affirms thatit neither has norseeks the ability to remove or edit what information is made available on social media 
platforms. CISA makes no recommendations about how the information itis sharing should be handled or used by social 
media companies. Additionally, CISA will not take any action, favorable orunfavorable, toward social media companies 
based on decisions about how or whether to use this information, 


From: Misinformation Reports <misinformation@cisecurity.org> 

Sent: Friday, October 2, 2020 6:09 PM 

To: cisa.dhs.gov>; © cisa.dhs.cov> hq.dhs.gov>; 
2020partnership.atlassian.net; Misinformation Reports <misinformation@cisecurity.org> 

Subject: Case #CIS-MISO00026: Facebook misinformation regarding absentee ballots mailed outin Scott County, IA. 


aa This email originated from outs ide Of DHS. DO NOT click links or open attachments unless you recognize and/or trust the | 


|sender. Contact your component SOC with questions or concerns. 


Misinformation report from Scott County, IA 


From © msisac.org> 

Sent: Friday, October 2, 2020 5:54 PM 

To: Misinformation Reports <misinformation@cisecurity.org> 
Subject: FW: Facebook misinformation 


In response to your last email to eric. 


From: sos.iowa.gov> 
Sent: Friday, October 2, ; 


To: msisac.org>; msisac.org> iowa. ov ii 
dps.state.ia.Us>; [I ESIZS (FB!) SNEBIREIN @fbi.cov>; 


hq.dhs.gov> 


Ce: S0S.iowa.gov>; sos.iowa.gov> 


Subject: Fwd: Facebook misinformation 
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Please see this report of possible misinformation posted on Facebook. We received it from the Scott County 
I’ve confirmed tha iE a registered voterin Scott County, IA. 


Absentee ballots will not be mailed out in lowa until Monday, October 5. 
Forwarding for visibility. 


Let me knowif you have more questions. 


Get Outlook foriOS 


Sent: Friday, October 2, 2020 12:54 PM 


To: 
Subject: FW: Facebook misinformation 


Sent: Friday, October 2, 2020 11:33 AM 


To: @sos.iowa.gov> 


Subject: Fwd: Facebook misinformation 


As perthe incident reportl|am moving forward with inacurate 
information posted on Facebook. Of course we have notmailed out ballots yet, therefore false information. Can you tell 
me what action will be taken 


wonennne = Forwarded message --------- 

(or I ct l.com> 
Date: Thu, Oct 1, 2020, 8:57 PM 

Subject: Facebook misinformation 


To: mail.com> 


Sentfrom my iPhone 
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This message and attachments may contain confidential information. If it appears that this message was sent to you by 
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all Verizon > v=) 


| got 3 mail-in 
ballots. Seems 
fishy to me. 


Destroyed them, 
voting in person. 


onder how many haters would 
send in all 3.... just wondering 
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Bemwewsri| 
AMEN TO THAT... 


1d Like Reply 


Good for you. My relatives called 
city hall and reported it. | told them 
to call the local TV stationsvand see if 
they put it on the air. Any'bets? 


1d Like Reply ©1 


View 4 previous,replies... 


ee 


independent or not, you are 
backing the Republican party of 
Trump this year, as evidenced by 
many of your posts and 
comments. 


1d Like Reply 


PY vote on 


Write a commenrt... GIF) © 
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Pa 

=| Good for you. My relatives called 
city hall and reported it. | told them 
to call the local TV stations and see if 
they put it on the air. Any bets? 
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sure should! This reeks of 
corruption! 


1d Like Reply 


They'only dwell on news that 
benefits one side. Plus they 
don't want Davenport or the 
state looking corrupt. 


1d Like Reply 
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a Republican so | guess that 


manne ttiuasnaiuild hanafit tha 
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is 
a Republican so | guess that 
means it would benefit the 
Republican party, not the 
Democrats, if she were to submit 
these illegitimate ballots, which 
she cannot do. lowa hasn't even 
mailed ballots out yet» It.seems 
to me that someone out there is 
purposely trying to, stir up trouble 
and cause’doubt.. Maybe the 
ballots she,received should have 
been brought to the attention of 
the county auditor. 
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ES 
Ef you're 
talking about this I'ma 
registered independent. Be sure 
of your facts before you state 
them. 
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